You are currently offline, waiting for your internet to reconnect

How to create custom events

Support for Windows XP has ended

Microsoft ended support for Windows XP on April 8, 2014. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article was previously published under Q324145
This step-by-step article describes how to create custom events. You can create custom events in an event log by using the Eventcreate utility. This can be useful as a diagnostic tool in scripts when you record an error or event directly into the logs without using VBScript or another language to log the event.

back to the top

The Eventcreate utility

Eventcreate is a command-line utility that you can start at a command prompt or by clicking Start and then typing in the Run dialog box. The following switches are available for the command:
  • /s computer
    Specifies the name or IP address of a remote computer with which to log the event. The default computer is the local computer.
  • /u domain\user
    Runs the command with the permissions of the specified user. The default user is the current user.
  • /p password
    Specifies the password of the user account that is specified in the /u parameter.
  • /l
    Specifies the name of the log where the event will be created. Only APPLICATION or SYSTEM are permitted.
  • /so source name
    Specifies the source name that is generating the event, and this can be any string, but is typically the program.
  • /t
    Specifies the type of event to create. The valid event types are ERROR, WARNING, and INFORMATION.
  • /id EventID
    Specifies the event ID for the event. This must be an integer between 1 and 1000. IDs do not have to be unique, and it is a good idea to use them to record an identifiable error number such as the exit code from a program.
  • /d description
    Specifies the description to use for the newly-created event. Use quotation marks (") to specify a multi-word string.
  • /?
    Displays help at the command prompt.
NOTE: You must supply values for the /t, /id and /d options, and another value for the /l or /so option.

back to the top

Create an event in the Application Log

To create an error event in the Application log with the "Application failed" description, use the eventcreate /t error /id 1000 /l application /d "Application failed" command.

back to the top

Create an event for a specific program in the Application log

To create an information event in the program for Winword.exe with the "Printed ten documents" description, use the eventcreate /t information /id 1 /l application /so winword /d "Printed ten documents" command.

back to the top

Create an event on one or more remote computers

You can use the /s switch to write to an event log on a remote computer. For example, to write the previous event into the Application log on the server that is named "TestServer", run the eventcreate /s testserver /t information /id 1 /l application /so winword /d "Printed ten documents" command. By default, the Eventcreate uses the user credentials of the current user to write the event. If the user does not have the appropriate rights, the command does not work. To specify different credentials, use the /u and /p switches to specify the user, domain, and password to use. For example, to use the user "logwriter" in the domain "Microsoft" with the password "writelog", run the eventcreate /s sentient /u Microsoft\logwriter /p writelog /t information /id 1 /l application /so winword /d "Printed ten documents" command. You can also write to multiple logs by specifying additional /s parameters. For example, you might run the eventcreate /s sentient /s intelligent /u Microsoft\logwriter /p writelog /t information /id 1 /l application /so winword /d "Printed ten documents" command to do so.NOTE: For these procedures to work correctly, the user name and password must be valid across all of these computers. If the user name and password combinations are different for each computer, you must use separate eventcreate commands.

back to the top

Article ID: 324145 - Last Review: 02/07/2006 17:27:10 - Revision: 2.3

  • Microsoft Windows XP Professional
  • kbhowto kbhowtomaster KB324145