How to use the Event Query Script tool (Eventquery.pl) in Microsoft Windows 2000
IN THIS TASK
An event is any significant occurrence in the system, or in a program, that requires that users be notified or requires that an entry be made to a log. The Event Log Service records events to the Application, Security, and System logs in Event Viewer. Also, events are written to the Directory Service and File Replication Service logs on domain controllers, and the DNS Server log on Domain Name System (DNS) servers.
By using Event Viewer, you can obtain information about your hardware, software, and system components, and you can monitor security events on a local or remote computer. Event logs can help you identify and diagnose the source of current system problems and help you predict potential system problems.
back to the top
System Requirements for Eventquery.plThe Event Query Script tool is available in the Microsoft Windows 2000 Resource Kit Supplement 1. This script tool runs on a source computer and acts on a target computer (which can be the same computer as the source computer). Before you can use this tool to query the Event logs of the local or a remote computer, the following requirements must be met:
back to the top
- The computer is running either Windows 2000 Professional or Windows 2000 Server.
- ActiveState ActivePerl Build 521 is installed. This program is available in the Windows 2000 Resource Kit.
The computer must also be correctly configured to run the Perl scripts that are included in the Windows 2000 Resource Kit Supplement 1. The Resource Kit WMI provider module, Wmi.pm, must be in the Perl Installation Folder\Site\Lib\W2rk folder. The Resource Kit Setup program typically creates the W2rk folder and copies the Wmi.pm file to this folder.
If Setup does not automatically create the W2rk folder, you can manually create it and configure the environment in which to run Eventquery.p. For more information about how to do this, see the Troubleshooting section later in this article.
- You must be logged in as a member of the Administrators group to view Security log events.
- The computer is running either Windows 2000 Professional or Windows 2000 Server
Overview of Eventquery.plEventquery.pl uses the following syntax:
- EventLog [ EventLog...]| *: Use this parameter to specify the event logs that you want to search. If you want to search two or more event logs, separate each log with a space. If you want to search all event logs, use the wildcard character (*). If the event log name contains a space, enclose the name with quotation marks (").
- -s Computer: Use this parameter to specify the name or IP address of a remote computer. If you omit this parameter, the local computer is specified.
- -u Domain\User: Use this parameter to specify the user account with which to run Eventquery.pl. If you omit this parameter, Eventquery.pl uses the permissions of the currently logged-on user. If you use this parameter, you must also use the -p parameter to provide the user's password.
- -p Password: Use this parameter to specify the password of the user account that is specified by the -u parameter. The -p parameter is required if you use the -u parameter.
- -range n|-n |Begin-End: Use this parameter to specify the number of events that appear from each event log. If you omit this parameter, Eventquery.pl displays all events.
- n: Use this variable to specify the most recent n events in each log, which will appear in descending order, where n is a whole number greater than 0 (zero).
- -n: Use this variable to specify the last (oldest) n events in each log, which will appear in ascending order, where -n is a whole number greater than 0 (zero).
- Begin-End: Use this variable to define a range of events in each log, where Begin and End are whole numbers greater than 0 (zero).
- -format table|list| csv: Use this parameter to specify the output format. If you omit this parameter, Eventquery.pl uses the table format.
- -v: Use this parameter to add the event Data and Description sections to the display.
- -filter "FieldOperatorValue" [-filter "FieldOperatorValue"...]: Use this parameter to specify the criteria for events that are included in the display. If you omit this parameter, all events appear. Use a separate instance of -filter "FieldOperatorValue" for each criteria that you want to specify, and separate each parameter with a space.
The following table lists the operators and values that are available for each field that is used with the -filter parameter. The table also provides an example of each "FieldOperatorValue":
|Type||= !||Error | Information | Warning (System and Application logs) | SuccessAudit or FailureAudit (Security Log)||"Type=Error"|
|DateTime||All logical operators||Date in mm/dd/[yy]yy format or Date:Time in mm/dd/[yy]yy:hh:[mm:[ss[am|pm]]] format||"datetime>02/08/2002:11:59:59PM"|
|Source||= !||Name of the component that logged the event.||"source=Service Control Manager"|
|Category||= !||A valid event classification||"category=Policy Change"|
|ID||All logical operators.||An event identifier||"ID!88"|
|Computer||= !||A valid computer name.||"computer=server2"|
back to the top
- To display all events in the Application log of the local computer in the default table format, type the following line at the command prompt, and then press ENTER:eventquery.pl application
- To display details of all events in the System and DNS Server logs of a computer named Server8 in list format, type the following line at the command prompt, and then press ENTER:eventquery.pl system "dns server" -s server8 -format list -v
- To run Eventquery.pl by using the Administrators account to display the events in the Security log of a computer named Server5 in comma-delimited format and redirect the output to a file named Srv5_Sec.csv on drive E, type the following line at the command prompt, and then press ENTER:eventquery.pl security -s server5 -u mydomain\administrator -p mypassword -format csv > e:\srv5_sec.csv
- To display a detailed record of events in all event logs of the local computer that were recorded between 8:00 A.M and 8:20 A.M. on February 8, 2002, in list format, type the following line at the command prompt, and then press ENTER:eventquery.pl * -format list -v -filter "datetime>02/08/2002:8:00am" -filter "datetime<02/08/2002:08:20am"
- To search the System log for instances of Windows File Protection Event ID 64004 and then display the events in default table format, type the following line at the command prompt, and then press ENTER:eventquery.pl system -filter "source=windows file protection" -filter "id=64004" -v
- To display the five most recent events from the Application log on a computer named Server8 in the default table format and redirect the output to the App_new.txt file, type the following line at the command prompt, and then press ENTER:eventquery.pl application -s server8 -range 5 > app_new.txt
- To display all error events (except Event ID 100) that are recorded in the Application log by a program named MyApp in comma-delimited format and redirect the output to the C:\Myapp\Errors.csv file, type the following line at the command prompt, and then press ENTER:eventquery.pl application -filter "type=error" -filter "source=myapp" -filter "id!100" -format csv > c:\myapp\errors.csv
TroubleshootingWhen you try to run Eventquery.pl, you receive the following error message:
Copy Wmi.pm from the Resource Kit directory to /Perl/site/lib/W2RK.
To resolve this behavior, manually configure the environment in which to run Perl scripts:
- Create a folder named W2rk in the Perl Installation Folder\Site\Lib folder.
NOTE: The default Perl Installation Folder is drive:\Perl where drive is the drive on which Windows is installed.
- Copy the Wmi.pmi file from the folder in which the Windows 2000 Resource Kit is installed (typically, \Program Files\Resource Kit) to the W2rk folder that you created in step 1.
back to the top
Article ID: 317381 - Last Review: 12/07/2015 08:52:12 - Revision: 6.3
- kbnosurvey kbarchive kberrmsg kbhowto kbhowtomaster KB317381