PsLoglist v2.61 - local and remote event log viewer
Copyright (C) 2000-2005 Mark Russinovich
Sysinternals - www.sysinternals.com
PsLogList dumps event logs on a local or remote NT system.
Usage: psloglist [\\computer[,computer2[,...] | @file] [-u username [-p password]]] [-s [-t delimite
r]] [-m #|-n #|-d #|-h #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy] [-f filter] [-i ID,[ID,...]] | -e
ID,[ID,...]] [-o event source[,event source[,...]]] [-q event source[,event source[,...]]] [[-g|-l]
event log file] <event log>
@file Psloglist will execute the command on each of the computers
listed in the file.
-a Dump records timestamped after specified date.
-b Dump records timestamped before specified date.
-c Clear event log after displaying.
-d Only display records from previous n days.
-e Exclude events with the specified ID or IDs (up to 10).
-f Filter event types, using starting letter
(e.g. "-f we" to filter warnings and errors).
-g Export an event log as an evt file. The can only be used
with the -c switch (clear log).
-h Only display records from previous n hours.
-i Show only events with the specified ID or IDs (up to 10).
-l Dump the contents of the specified saved event log file.
-m Only display records from previous n minutes.
-n Only display n most recent records.
-o Show only records from the specified event source or sources
(e.g. "-o cdrom").
-p Specifies password for user name.
-q Omit records from the specified event source or sources
(e.g. "-q cdrom").
-r Dump log from least recent to most recent.
-s Records are listed on one line each with delimited
fields, which is convenient for string searches.
-t The default delimiter for the -s option is a comma,
but can be overriden with the specified character. Use "\t"
to specify tab.
-u Specifies optional user name for login to
-w Wait for new events, dumping them as they generate (local system
-x Dump extended data.
eventlog Specifies event log to dump. Default is system. If the
-l switch is present then the event log name specifies
how to interpret the event log file.