eventvwr arguments?

[djc]

first maybe I don't even need these... I was trying to setup an MMC 'TaskPad
View' in an attempt to setup a way for an assitant of mine to be able to
easily view the security log on multiple machines for some particular audit
events. Via mmc Taskpad I could add a snap-in for each machine (there are
only a handful) and then creates 'Tasks' that open the security log. However
I would ideally like the security log to be opened to a particular filtered
view so that only the particular event ID's are showing. I could not find a
way to do that via the mms TaskPad View and Tasks. Which brings me to why
I'm posting this. The other option with these Tasks is to run any command.
So, if eventvwr.exe takes any paramaters, like which log to open and some
filter options, then I could just do that. A quick eventvwr.exe /? did not
reveal any options.

anyone know if there are some undocumented switches that will help me here?
Or if you happen to know about the mms Task Pad Views and Tasks and you know
of a way to do what I'm looking for that would be appreciated as well.

thanks.

 

[Mark V]

first maybe I don't even need these... I was trying to setup an
MMC 'TaskPad View' in an attempt to setup a way for an assitant of
mine to be able to easily view the security log on multiple
machines for some particular audit events. Via mmc Taskpad I could
add a snap-in for each machine (there are only a handful) and then
creates 'Tasks' that open the security log. However I would
ideally like the security log to be opened to a particular
filtered view so that only the particular event ID's are showing.
I could not find a way to do that via the mms TaskPad View and
Tasks. Which brings me to why I'm posting this. The other option
with these Tasks is to run any command. So, if eventvwr.exe takes
any paramaters, like which log to open and some filter options,
then I could just do that. A quick eventvwr.exe /? did not reveal
any options.

anyone know if there are some undocumented switches that will help
me here? Or if you happen to know about the mms Task Pad Views and
Tasks and you know of a way to do what I'm looking for that would
be appreciated as well.

Not the answer to your questions but on topic for this group. Have
you looked at any of several eventlog viewers? Specifically in mind
is: psloglist.exe (www.sysinternals.com)
which could be used in an automated manner via batch or other
scripting language. And if I understand the problem to be solved
correctly of course.

PsLoglist v2.60 - local and remote event log viewer
Copyright (C) 2000-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

PsLogList dumps event logs on a local or remote NT system.

Usage: psloglist [\\computer[,computer2[,...] | @file] [-u username
[-p password]]] [-s [-t delimite
r]] [-m #|-n #|-d #|-h #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy] [-
f filter] [-i ID,[ID,...]] | -e
ID,[ID,...]] [-o event source[,event source[,...]]] [-q event source
[,event source[,...]]] [-l even
t log file] <event log>
...
-i Show only events with the specified ID or IDs (up to 10).
...

 

[djc]

cool. I'll check that out. Thanks!

first maybe I don't even need these... I was trying to setup an
MMC 'TaskPad View' in an attempt to setup a way for an assitant of
mine to be able to easily view the security log on multiple
machines for some particular audit events. Via mmc Taskpad I could
add a snap-in for each machine (there are only a handful) and then
creates 'Tasks' that open the security log. However I would
ideally like the security log to be opened to a particular
filtered view so that only the particular event ID's are showing.
I could not find a way to do that via the mms TaskPad View and
Tasks. Which brings me to why I'm posting this. The other option
with these Tasks is to run any command. So, if eventvwr.exe takes
any paramaters, like which log to open and some filter options,
then I could just do that. A quick eventvwr.exe /? did not reveal
any options.

anyone know if there are some undocumented switches that will help
me here? Or if you happen to know about the mms Task Pad Views and
Tasks and you know of a way to do what I'm looking for that would
be appreciated as well.

Not the answer to your questions but on topic for this group. Have
you looked at any of several eventlog viewers? Specifically in mind
is: psloglist.exe (www.sysinternals.com)
which could be used in an automated manner via batch or other
scripting language. And if I understand the problem to be solved
correctly of course.

PsLoglist v2.60 - local and remote event log viewer
Copyright (C) 2000-2004 Mark Russinovich
Sysinternals - www.sysinternals.com

PsLogList dumps event logs on a local or remote NT system.

Usage: psloglist [\\computer[,computer2[,...] | @file] [-u username
[-p password]]] [-s [-t delimite
r]] [-m #|-n #|-d #|-h #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy] [-
f filter] [-i ID,[ID,...]] | -e
ID,[ID,...]] [-o event source[,event source[,...]]] [-q event source
[,event source[,...]]] [-l even
t log file] <event log>
...
-i Show only events with the specified ID or IDs (up to 10).
...