PsLogList

The PsLogList application was developed to be a small command line tool that will show the contents of the System Event Log on the local computer, with visually-friendly formatting of Event Log records. Command line options let you view logs on different computers, use a different account to view a log, or to have the output formatted in a string-search friendly way.

psloglist [-?] [\computer[,computer[,...] | @file [-u username [-p password]]] [-s [-t delimiter]] [-m #|-n #|-h #|-d #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy][-f filter] [-i ID[,ID[,...] | -e ID[,ID[,...]]] [-o event source[,event source][,..]]] [-q event source[,event source][,..]]] [-l event log file]

@file Execute the command on each of the computers listed in the file. -a Dump records timestamped after specified date. -b Dump records timestamped before specified date. -c Clear the event log after displaying. -d Only display records from previous n days. -e Exclude events with the specified ID or IDs (up to 10). -f Filter event types with filter string (e.g. "-f w" to filter warnings). -h Only display records from previous n hours. -i Show only events with the specified ID or IDs (up to 10). -l Dump records from the specified event log file. -m Only display records from previous n minutes. -n Only display the number of most recent entries specified. -o Show only records from the specified event source (e.g. "-o cdrom"). -p Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password. -q Omit records from the specified event source or sources (e.g. "-q cdrom"). -r Dump log from least recent to most recent. -s This switch has PsLogList print Event Log records one-per-line, with comma delimited fields. This format is convenient for text searches, e.g. psloglist | findstr /i text, and for importing the output into a spreadsheet. -t The default delimeter is a comma, but can be overriden with the specified character. -u Specifies optional user name for login to remote computer. -w Wait for new events, dumping them as they generate (local system only). -x Dump extended data. eventlog