Solved

Pull warnings/errors from event viewer via script

Posted on 2010-09-06
11
657 Views
Last Modified: 2012-05-10
Hi Experts.  Much like another question I just asked, I was curious how I could go about using a script or batch file to look through a computers event viewer and export/dump the errors and warnings for a particular time period (last 2 months/1 month/1week, etc).

This would be for Windows based OS's.  Since I am not a programmer/scripter, I appreciate your help and patience with this!
0
Comment
Question by:samiam41
  • 7
  • 3
11 Comments
 
LVL 4

Expert Comment

by:erik_nodland
ID: 33612290
Hi

The easiest way is to use something like log parser. You can download it from here
http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

You can use this to get all sorts of information. To query your application event log for the last 2 months just do
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message
FROM Application
where TimeGenerated > '2010-07-06 00:00:00' into test.csv"

This should export it out to a CSV file called test.csv

HTH

Erik
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612380
Thanks erik_nodland.  So I install this on the pc and then run the command you wrote?
0
 
LVL 4

Expert Comment

by:erik_nodland
ID: 33612454
Yep. Just install it and then run the command from the directory where it was installed.

cheers

Erik
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 
LVL 9

Author Comment

by:samiam41
ID: 33612503
I was able to create a quick batch file which launches the parcer app and gets the command switches to run except I am getting this error message:

Error: Syntax Error: extra token(s) after query: 'into'

Thoughts?
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612514
Quick snapshot of the script
cd\
cd "c:\program files\log parser 2.2"
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber, TimeGenerated, EventID,EventType, EventTypeName, EventCategory, SourceName,ComputerName, Message FROM Application where TimeGenerated > '2010-07-06 00:00:00' into test.csv"  
pause

Open in new window

0
 
LVL 9

Author Comment

by:samiam41
ID: 33612546
Got it!

Made a quick change to your command (see below):
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message into test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"

cd\
cd "c:\program files\log parser 2.2"
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber, TimeGenerated, EventID,EventType, EventTypeName, EventCategory, SourceName, ComputerName, Message INTO test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"  

Open in new window

0
 
LVL 9

Author Comment

by:samiam41
ID: 33612552
my ref:  http://technet.microsoft.com/en-us/library/ee692659.aspx

C:\>LogParser "SELECT TimeGenerated, SourceName,
EventCategoryName, Message INTO report.txt FROM Security WHERE
EventID = 528 AND SID LIKE '%TESTUSER%'" -resolveSIDs:ON

Thanks for your help!!
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612596
@erik, if you copy/paste what I put in 33612546 into a new comment, I can accept your answer and award points.
0
 
LVL 4

Accepted Solution

by:
erik_nodland earned 500 total points
ID: 33612756
Ahh yes sorry. I should have tested it out first. Glad you got it all going.

Made a quick change to your command (see below):

logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message into test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"

Cheers

Erik
0
 
LVL 9

Author Closing Comment

by:samiam41
ID: 33612769
Thanks for the help!!  Hope to work with you again!

-Aaron
0
 
LVL 53

Expert Comment

by:Bill Prew
ID: 33612860
Another tool you could look at for this job:

http://technet.microsoft.com/en-us/sysinternals/bb897544.aspx

~bp
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup" or a blinking cursor with black screen. A loop for Auto repair will start but fix nothing.  You will be panic as there are no back…
With User Account Control (UAC) enabled in Windows 7, one needs to open an elevated Command Prompt in order to run scripts under administrative privileges. Although the elevated Command Prompt accomplishes the task, the question How to run as script…
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question