Home > Commands A-M > Commands E

EVENTQUERY


Description | Syntax | Parameters | Switches | Related | Notes | Examples | Errorlevels | Availability

Lists the events and event properties from one or more event logs.


Syntax

CSCRIPT EVENTQUERY.VBS /?

CSCRIPT EVENTQUERY.VBS [/s computer [/u [Domain\]User [/p password]]] [/fi filter_name] [/fo format] [/nh] [/r event_range] [/v] [/l log [/l log ...]]


Parameters

none.


Switches
/? (NTXP)
Displays help.
/fi filter_name (NTXP)
Specifies the types of events to include in or exclude from the query. To find events with either value, Type and ID can be used together in a single syntax statement by using the or operator. The valid filter names, operators, and values:
      Name      Operator                      Value
      Datetime  eq, ne, ge, le, gt, lt        mm/dd/yy(yyyy), hh:mm:ssAM(/PM)
      Type      eq, ne, or                    {ERROR | INFORMATION | WARNING | SUCCESSAUDIT | FAILUREAUDIT}
      ID        eq, ne, or, ge, le, gt, lt    Any valid positive integer.
      User      eq, ne                        Any valid string.
      Computer  eq, ne                        Any valid string.
      Source    eq, ne                        Any valid string.
      Category  eq, ne                        Any valid string
/fo format (NTXP)
Specifies the format to use for the output. Valid values are:
/l log [/l log ...] (NTXP)
Specifies the name of the event log where the event will be created. The valid log names are:
/nh (NTXP)
Suppresses column headers in the output. Valid only for table and csv formats.
/p password (NTXP)
Specifies the password of the user account that is specified in /u.
/r event_range (NTXP)
Specifies the range of events to list.
/s computer (NTXP)
Specifies the name or IP address of a remote computer (do not use backslashes). The default is the local computer.
/u [Domain\]User (NTXP)
Runs the command with the account permissions of the user specified by User or Domain\User. The default is the permissions of the current logged on user on the computer issuing the command.
/v (NTXP)
Specifies that verbose event information be displayed in the output.

Related

none.


Notes

none.


Examples

none.


Errorlevels

none.


Availability
External
DOS
none
Windows
none
Windows NT
NTXP NT2003