Event Viewer

[Guest]

How do I make the filter settings in Event Viewer permanent. I do not have an
options setting for "save settings on exit" in my Event Viewer.

 

[Lawrence Tse]

As far as I know, there should have no such command line parameter or option
for Event Viewer.

You can employ an alternative by WMI scripting, and outputing the event you
want to view.

==================
strComputer = "."

Set objWBEM = _
GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set oEvents = objWBEM.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE
Logfile=""Application"" And Type=""""")

For Each o in oEvents

WScript.Echo "Computer Name: " & o.ComputerName & vbCrLF & _
"Event Type: "& o.Type & vbCrLf & _
"Log Category: " & o.LogFile & vbCrLf & _
"Log Message: " & o.Message
Next
==================
You may need to modify the script to suit your need. Explore more on the
Technet Script Center:
http://www.microsoft.com/technet/scriptcenter/default.mspx

 

[Lawrence Tse]

The previous script have something missing, type this one out instead if you
need:
===============
strComputer = "."

Set objWBEM = _
GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set oEvents = objWBEM.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE
Logfile=""Application"" And Type=""error""")

For Each o in oEvents

WScript.Echo "Computer Name: " & o.ComputerName & vbCrLF & _
"Event Type: "& o.Type & vbCrLf & _
"Log Category: " & o.LogFile & vbCrLf & _
"Log Message: " & o.Message
Next
=================