Event Log Query Tool

Access an event-log summary from the command line

Windows 2000 and Windows NT administrators quickly learn the value of the event logs. If you don't look over the event logs every day or two, you might miss some important warnings or errors. But starting up the Microsoft Management Console (MMC) Computer Management snap-in is a pain—you're more likely to scan event logs regularly if you have a command-line tool.

Event Log Query Tool, an automated tool for examining event logs, is available in the Microsoft Windows 2000 Server Resource Kit Supplement One. Elogdmp.exe is a bit limited, but with some work on your part, it can be quite useful. The tool dumps an event-log summary to the screen. You can then search the output for particular keywords or pipe it into a batch file for processing.

Elogdmp's syntax is

elogdmp  

Computername is the name of the computer whose log you want to dump—Elogdmp takes NetBIOS names, IP addresses, and some (but not all) DNS names (preceding backslashes aren't required). Logname is the name of the log that you want to see (e.g., Security, Application, Directory Service). Case doesn't seem to matter, but if the log name contains a space, enclose the name in quotation marks.

So, for example, to dump the System log on a machine named \mypc, you'd type

elogdmp mypc system

If \mypc is a DNS server, you can type

elogdmp mypc "dns server"

to view the DNS Server log. The output is a comma-delimited dump of the log's contents: the date, time, source, type, category, event ID, user, and machine information. Most of the fields are self-explanatory, but the source, type, and category fields need some explanation.

The source field identifies the program (e.g., w32time, DNS) that created the log entry, and the type field contains the severity level (i.e., INFO, WARN, or ERROR). In a log file you view using the Computer Management snap-in, the category field provides more specific information about the system than the source field does—for example, an Active Directory (AD)­related message announcing that the OS has begun defragmenting AD might display NTDS ISAM as the source and the more helpful Online Defragmentation as the category. Unfortunately, Elogdmp's category field is singularly unhelpful: It contains only the word None or Something.

Although Elogdmp doesn't display the actual message that triggered the log entry, the tool still can be useful from the command line or in a batch file. For example

elogdmp mypc system | find "ERROR"

will show all System event-log entries of type ERROR (the Find command is case sensitive, so ERROR must be in capital letters). The entries appear from the oldest to the most recent, so you'll see today's errors even if the bulk of the output scrolls off the screen.

Elogdmp is terse in its error reporting. If it can't satisfy your request (e.g., if you query an event log on a machine that you don't have permissions to), you'll get a decidedly unhelpful error such as

elogdmp: cannot open the 'system' event log (5)

To determine the reason for the error, you need to know that the number in parentheses is the number of the error. Error 5 happens to be an access-denied error. To see what an error means, you can use the Net Helpmsg command. For example, typing

net helpmsg 5

at a command prompt produces the response access is denied.