Select the product you need help with

How to create custom events

Article ID: 324145 - View products that this article applies to.

This article was previously published under Q324145

SUMMARY

This step-by-step article describes how to create custom events. You can create custom events in an event log by using the Eventcreate utility. This can be useful as a diagnostic tool in scripts when you record an error or event directly into the logs without using VBScript or another language to log the event.

The Eventcreate utility

Eventcreate is a command-line utility that you can start at a command prompt or by clicking Start and then typing in the Run dialog box. The following switches are available for the command:

/s computer
Specifies the name or IP address of a remote computer with which to log the event. The default computer is the local computer.
/u domain\user
Runs the command with the permissions of the specified user. The default user is the current user.
/p password
Specifies the password of the user account that is specified in the /u parameter.
/l
Specifies the name of the log where the event will be created. Only APPLICATION or SYSTEM are permitted.
/so source name
Specifies the source name that is generating the event, and this can be any string, but is typically the program.
/t
Specifies the type of event to create. The valid event types are ERROR, WARNING, and INFORMATION.
/id EventID
Specifies the event ID for the event. This must be an integer between 1 and 1000. IDs do not have to be unique, and it is a good idea to use them to record an identifiable error number such as the exit code from a program.
/d description
Specifies the description to use for the newly-created event. Use quotation marks (") to specify a multi-word string.
/?
Displays help at the command prompt.

NOTE: You must supply values for the /t, /id and /d options, and another value for the /l or /so option.

Create an event in the Application Log

To create an error event in the Application log with the "Application failed" description, use the eventcreate /t error /id 1000 /l application /d "Application failed" command.

Create an event for a specific program in the Application log

To create an information event in the program for Winword.exe with the "Printed ten documents" description, use the eventcreate /t information /id 1 /l application /so winword /d "Printed ten documents" command.

Create an event on one or more remote computers

You can use the /s switch to write to an event log on a remote computer. For example, to write the previous event into the Application log on the server that is named "TestServer", run the eventcreate /s testserver /t information /id 1 /l application /so winword /d "Printed ten documents" command. By default, the Eventcreate uses the user credentials of the current user to write the event. If the user does not have the appropriate rights, the command does not work. To specify different credentials, use the /u and /p switches to specify the user, domain, and password to use. For example, to use the user "logwriter" in the domain "Microsoft" with the password "writelog", run the eventcreate /s sentient /u Microsoft\logwriter /p writelog /t information /id 1 /l application /so winword /d "Printed ten documents" command. You can also write to multiple logs by specifying additional /s parameters. For example, you might run the eventcreate /s sentient /s intelligent /u Microsoft\logwriter /p writelog /t information /id 1 /l application /so winword /d "Printed ten documents" command to do so. NOTE: For these procedures to work correctly, the user name and password must be valid across all of these computers. If the user name and password combinations are different for each computer, you must use separate eventcreate commands.