8.2. Viewing Events

Problem

You want to view events in an event log.

Solution

Using a graphical user interface

  1. Open the Event Viewer (eventvwr.msc). To connect to a remote computer, in the left pane right-click the Event Viewer icon and select Connect to another computer.

  2. In the left pane, click on the event log containing the events you want to view.

  3. Double-click on an event you want to view in the right pane.

Using a command-line interface

You can use either the eventquery.vbs or psloglist commands to list the events in an event log. In both of the following examples, the last 10 records from the Application log are displayed. Both commands have numerous other options to view events, so look at the command syntax help for more information.

> eventquery.vbs /s <ServerName> /l <LogName> /R <MaxEvents>

For example:

> eventquery.vbs /s server01 /l Application /R 10

Using psloglist:

> psloglist \\<ServerName> -n <MaxEvents> 
                  <LogName>

For example:

> psloglist \\server01 -n 10 Application

Using VBScript

' This code displays events in an Event Log.
' ------ SCRIPT CONFIGURATION ------
strLog = "<LogName>"       ' e.g., Application
intNum = <intMax>          ' e.g., 10  (Max number of events to display)
strServer = "<ServerName>" ' e.g., fs01 (use "." for local server) ' ------ END CONFIGURATION --------- ' These constants are taken from WbemFlagEnum const wbemFlagReturnImmediately = 16 const wbemFlagForwardOnly = 32 ' This first part is used to determine how many events are in the log set objWMI = GetObject("winmgmts:\\" ...

Get Windows Server Cookbook now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.