Posts Tagged ‘PsLogList’

EventLog Query Options

March 1, 2010 1 comment

This post is actually an answer to Grant’s question.
I quote:

"I discovered eventcombmt today and have been playing round with it. I have an application whereby I want to write out a listing showing any/all accesses by a particular user. I want to run this once a day. I have not been able to figure out what the commandline switch is to specify to only scan the last 24 hours.
Do you know what it is?"


Well Grant, If you want to use EventCombMT, you can use the command line parameters /before & /after but then you’ll need to specify the full date and time in the form of MMDDYYYYHHMMSS. The date-time format needs to be exactly 14 characters, and both parameters must be used together. I think this only works in the ALTools version.

A more elegant way, would be to use Log Parser and query the Security EventLog using:

LogParser "SELECT * INTO C:\myEvents.xml FROM \\Server1\Security,\\Server2\Security WHERE EXTRACT_TOKEN(Strings, 1, ‘|’) = ‘myUser’ AND TimeGenerated >= TO_LOCALTIME(SUB(SYSTEM_TIMESTAMP(), TIMESTAMP(’23:59:59′, ‘hh:mm:ss’)))"

(You can open the C:\myEvents.xml with Excel as an XML table).


But… A simpler way, would be to use PsLogList from the Sysinternals Suite and run the command:

PsLoglist \\Server1,Server2 -s -h 24 security |find "myUser" >c:\myEvents.log


Which one do you prefer?