Celebrate National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Pull warnings/errors from event viewer via script

Posted on 2010-09-06
11
Medium Priority
?
669 Views
Last Modified: 2012-05-10
Hi Experts.  Much like another question I just asked, I was curious how I could go about using a script or batch file to look through a computers event viewer and export/dump the errors and warnings for a particular time period (last 2 months/1 month/1week, etc).

This would be for Windows based OS's.  Since I am not a programmer/scripter, I appreciate your help and patience with this!
0
Comment
Question by:samiam41
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 3
11 Comments
 
LVL 4

Expert Comment

by:erik_nodland
ID: 33612290
Hi

The easiest way is to use something like log parser. You can download it from here
http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

You can use this to get all sorts of information. To query your application event log for the last 2 months just do
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message
FROM Application
where TimeGenerated > '2010-07-06 00:00:00' into test.csv"

This should export it out to a CSV file called test.csv

HTH

Erik
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612380
Thanks erik_nodland.  So I install this on the pc and then run the command you wrote?
0
 
LVL 4

Expert Comment

by:erik_nodland
ID: 33612454
Yep. Just install it and then run the command from the directory where it was installed.

cheers

Erik
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 9

Author Comment

by:samiam41
ID: 33612503
I was able to create a quick batch file which launches the parcer app and gets the command switches to run except I am getting this error message:

Error: Syntax Error: extra token(s) after query: 'into'

Thoughts?
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612514
Quick snapshot of the script
cd\
cd "c:\program files\log parser 2.2"
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber, TimeGenerated, EventID,EventType, EventTypeName, EventCategory, SourceName,ComputerName, Message FROM Application where TimeGenerated > '2010-07-06 00:00:00' into test.csv"  
pause

Open in new window

0
 
LVL 9

Author Comment

by:samiam41
ID: 33612546
Got it!

Made a quick change to your command (see below):
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message into test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"

cd\
cd "c:\program files\log parser 2.2"
logparser -i:evt -o:csv "SELECT EventLog, RecordNumber, TimeGenerated, EventID,EventType, EventTypeName, EventCategory, SourceName, ComputerName, Message INTO test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"  

Open in new window

0
 
LVL 9

Author Comment

by:samiam41
ID: 33612552
my ref:  http://technet.microsoft.com/en-us/library/ee692659.aspx

C:\>LogParser "SELECT TimeGenerated, SourceName,
EventCategoryName, Message INTO report.txt FROM Security WHERE
EventID = 528 AND SID LIKE '%TESTUSER%'" -resolveSIDs:ON

Thanks for your help!!
0
 
LVL 9

Author Comment

by:samiam41
ID: 33612596
@erik, if you copy/paste what I put in 33612546 into a new comment, I can accept your answer and award points.
0
 
LVL 4

Accepted Solution

by:
erik_nodland earned 2000 total points
ID: 33612756
Ahh yes sorry. I should have tested it out first. Glad you got it all going.

Made a quick change to your command (see below):

logparser -i:evt -o:csv "SELECT EventLog, RecordNumber,
TimeGenerated, EventID,
EventType, EventTypeName, EventCategory, SourceName,
ComputerName, Message into test.csv FROM Application where TimeGenerated > '2010-07-06 00:00:00'"

Cheers

Erik
0
 
LVL 9

Author Closing Comment

by:samiam41
ID: 33612769
Thanks for the help!!  Hope to work with you again!

-Aaron
0
 
LVL 57

Expert Comment

by:Bill Prew
ID: 33612860
Another tool you could look at for this job:

http://technet.microsoft.com/en-us/sysinternals/bb897544.aspx

~bp
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
There are many software programs on offer that will claim to magically speed up your computer. The best advice I can give you is to avoid them like the plague, because they will often cause far more problems than they solve. Try some of these "do it…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question