Managing event logs from the command line

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Managing event logs from the command line

Opening Event Viewer from the command line

You can launch Event Viewer from the command-line using eventvwr.exe or mmc.exe. Either command opens Event Viewer.

Syntax for eventvwr.exe

eventvwr.exe

Parameters

computername

Specifies the computer you want to target, where computername is the name of the target computer. If you do not specify a computer, Event Viewer displays the logs on the local computer. You can specify a remote computer for computername, if you are a member of the Administrators group, or have been delegated the appropriate authority, on the remote computer.

or

Syntax for mmc.exe

mmc.exe X:\WINDOWS\system32\eventvwr.msc

Where X:\WINDOWS\System32 is the default path to eventvwr.msc, and X is the folder where Windows is installed.

Parameters

/computer=computername

Specifies the computer you want to target, where computername is the name of the target computer. If you do not specify a computer, Event Viewer displays the logs on the local computer. You can specify a remote computer for computername, if you are a member of the Administrators group, or have been delegated the appropriate authority, on the remote computer.

/auxsource=computername

Enables Event Viewer to obtain the information about events from a computer on which the event log service is installed. This can be the computer that generated the log or another computer on the network. You can use the /auxsource=computername parameter on computers running a Windows XP or later operating system. To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure.

Using command-line tools to manage events and event logs

You can also use command-line utilities to create and query event logs and associate programs with particular logged events. For example, you can use Eventcreate to customize an event entry to a specified event log. Eventquery.vbs is used to list the events and event properties from one or more event logs. Eventtriggers enables you to create event triggers that will run programs upon the occurrence of specific events.

For information about other command-line utilities, see Command-line reference A-Z.