Иллюстрированный самоучитель по автоматической установке Windows XP

Средства анализа журнала событий

В ОС Windows XP включено новое средство (сценарий) анализа событий локального компьютера. Этот сценарий можно использовать для определения ошибок автоматической подачи заявки клиента и выполнения соответствующих действий. Справочная информация по этому средству, доступная из командной строки, представлена ниже:

Z:\>eventquery /?

    Microsoft (R) Windows Script Host Version 5.6
    Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.
    ----------------------------------------------------------------------
    EVENTQUERY.vbs [/S system [/U username [/P password]]] [/FI filter]
                   [/FO format] [/R range] [/NH] [/V] [/L logname | *]
    Description:
      The EVENTQUERY.vbs script enables an administrator to list
      the events and event properties from one or more event logs.
    Parameter List:
      /S   system         Specifies the remote system to connect to.
      /U   [domain\]user  Specifies the user context under which the
                          command should execute.
      /P   password       Specifies the password for the given
                          user context.
      /V                  Specifies that the detailed information
                          should be displayed in the output.
      /FI  filter         Specifies the types of events to
                          filter in or out of the query.
      /FO  format         Specifies the format in which the output
                          is to be displayed.
                          Valid formats are "TABLE", "LIST", "CSV".
      /R   range          Specifies the range of events to list.
                          Valid Values are:
                          'N' - Lists 'N' most recent events.
                          '-N' - Lists 'N' oldest events.
                          'N1-N2' - Lists the events N1 to N2.
      /NH                 Specifies that the "Column Header" should
                          not be displayed in the output.
                          Valid only for "TABLE" and "CSV" formats.
      /L   logname        Specifies the log(s) to query.
      /?                  Displays this help/usage.
                          Valid Filters Operators allowed  Valid Values
      ------------- ------------------ ------------
      DATETIME      eq,ne,ge,le,gt,lt  mm/dd/yy(yyyy),hh:mm:ssAM(/PM)
      TYPE          eq,ne              ERROR, INFORMATION, WARNING,
                                       SUCCESSAUDIT, FAILUREAUDIT
      ID            eq,ne,ge,le,gt,lt  non-negative integer
      USER          eq,ne        string
      COMPUTER      eq,ne        string
      SOURCE        eq,ne        string
      CATEGORY      eq,ne        string
    NOTE: Filter "DATETIME" can be specified as "FromDate-ToDate"
          Only "eq" operator can be used for this format.
    Examples:
      EVENTQUERY.vbs
      EVENTQUERY.vbs /L system
      EVENTQUERY.vbs /S system /U user /P password /V /L *
      EVENTQUERY.vbs /R 10 /L Application /NH
      EVENTQUERY.vbs /R -10 /FO LIST /L Security
      EVENTQUERY.vbs /R 5-10 /L "DNS Server"
      EVENTQUERY.vbs /FI "Type eq Error" /L Application
      EVENTQUERY.vbs /L Application /FI 
"Datetime eq 06/25/00,03:15:00AM-06/25/00,03:15:00PM"
      EVENTQUERY.vbs /FI "Datetime gt 08/03/00,06:20:00PM" 
/FI "Id gt 700" /FI "Type eq warning" /L System
      EVENTQUERY.vbs /FI "Type eq error OR Id gt 1000 "