EVENTQUERY

Lists the events and event properties from one or more event logs.

CSCRIPT EVENTQUERY.VBS /?

CSCRIPT EVENTQUERY.VBS [/s computer [/u [Domain\]User [/p password]]] [/fi filter_name] [/fo format] [/nh] [/r event_range] [/v] [/l log [/l log ...]]

none.

/? (NTXP)

Displays help.

/fi filter_name (NTXP)

Specifies the types of events to include in or exclude from the query. To find events with either value, Type and ID can be used together in a single syntax statement by using the or operator. The valid filter names, operators, and values:

      Name      Operator                      Value
      Datetime  eq, ne, ge, le, gt, lt        mm/dd/yy(yyyy), hh:mm:ssAM(/PM)
      Type      eq, ne, or                    {ERROR | INFORMATION | WARNING | SUCCESSAUDIT | FAILUREAUDIT}
      ID        eq, ne, or, ge, le, gt, lt    Any valid positive integer.
      User      eq, ne                        Any valid string.
      Computer  eq, ne                        Any valid string.
      Source    eq, ne                        Any valid string.
      Category  eq, ne                        Any valid string

/fo format (NTXP)

Specifies the format to use for the output. Valid values are:

• TABLE
• LIST
• CSV

/l log [/l log ...] (NTXP)

Specifies the name of the event log where the event will be created. The valid log names are:

• APPLICATION
• directory_log_name
• "DNS server" (only if DNS service is running on /s computer)
• SECURITY
• SYSTEM
• user_defined_log

/nh (NTXP)

Suppresses column headers in the output. Valid only for table and csv formats.

/p password (NTXP)

Specifies the password of the user account that is specified in /u.

/r event_range (NTXP)

Specifies the range of events to list.

• N Lists N most recent events
• -N Lists N oldest events
• N1-N2 Lists the events from N1 to N2

/s computer (NTXP)

Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer.

/u [Domain\]User (NTXP)

Runs the command with the account permissions of the user specified by User or Domain\User. The default is the permissions of the current logged on user on the computer issuing the command.

/v (NTXP)

Specifies that verbose event information be displayed in the output.

none.

none.

none.

none.

External

DOS

none

Windows

none

Windows NT

NTXP NT2003