Microsoft KB Archive/317381

= How to use the Event Query Script tool (Eventquery.pl) in Microsoft Windows 2000 =

Article ID: 317381

Article Last Modified on 3/2/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition

-



This article was previously published under Q317381



IN THIS TASK
SUMMARY System Requirements for Eventquerylog.pl
 * Source Computer
 * Target Computer

Overview of Eventquery.pl Examples Troubleshooting REFERENCES



SUMMARY
This article describes how to use the Event Query Script tool (Eventquery.pl file) to display events from Event Viewer logs of Microsoft Windows 2000-based computers.

An event is any significant occurrence in the system, or in a program, that requires that users be notified or requires that an entry be made to a log. The Event Log Service records events to the Application, Security, and System logs in Event Viewer. Also, events are written to the Directory Service and File Replication Service logs on domain controllers, and the DNS Server log on Domain Name System (DNS) servers.

By using Event Viewer, you can obtain information about your hardware, software, and system components, and you can monitor security events on a local or remote computer. Event logs can help you identify and diagnose the source of current system problems and help you predict potential system problems.

back to the top

System Requirements for Eventquery.pl
The Event Query Script tool is available in the Microsoft Windows 2000 Resource Kit Supplement 1. This script tool runs on a source computer and acts on a target computer (which can be the same computer as the source computer). Before you can use this tool to query the Event logs of the local or a remote computer, the following requirements must be met:

back to the top

Source Computer

 * The computer is running either Windows 2000 Professional or Windows 2000 Server.
 * ActiveState ActivePerl Build 521 is installed. This program is available in the Windows 2000 Resource Kit.

The computer must also be correctly configured to run the Perl scripts that are included in the Windows 2000 Resource Kit Supplement 1. The Resource Kit WMI provider module, Wmi.pm, must be in the \Site\Lib\W2rk folder. The Resource Kit Setup program typically creates the W2rk folder and copies the Wmi.pm file to this folder.

If Setup does not automatically create the W2rk folder, you can manually create it and configure the environment in which to run Eventquery.p. For more information about how to do this, see the Troubleshooting section later in this article.
 * You must be logged in as a member of the Administrators group to view Security log events.

back to the top

Target Computer

 * The computer is running either Windows 2000 Professional or Windows 2000 Server

back to the top

Overview of Eventquery.pl
Eventquery.pl uses the following syntax:

eventquery.pl [  ...] | * [ -s  [ -u  -p  ]] [ -range  |  |  ][ -format table | list | csv ] [  ][ -filter [ -filter ...]]

The parameters that you can use with Eventquery.pl are as follows:   [  ...]| *: Use this parameter to specify the event logs that you want to search. If you want to search two or more event logs, separate each log with a space. If you want to search all event logs, use the wildcard character (*). If the event log name contains a space, enclose the name with quotation marks (&quot;). -s : Use this parameter to specify the name or IP address of a remote computer. If you omit this parameter, the local computer is specified.  -u : Use this parameter to specify the user account with which to run Eventquery.pl. If you omit this parameter, Eventquery.pl uses the permissions of the currently logged-on user. If you use this parameter, you must also use the -p parameter to provide the user's password. -p : Use this parameter to specify the password of the user account that is specified by the -u parameter. The -p parameter is required if you use the -u parameter.

NOTE: Both the -p and -u parameters are available only if you use the -s parameter.

 -range |  | : Use this parameter to specify the number of events that appear from each event log. If you omit this parameter, Eventquery.pl displays all events.   : Use this variable to specify the most recent  events in each log, which will appear in descending order, where   is a whole number greater than 0 (zero).</li>  : Use this variable to specify the last (oldest)  events in each log, which will appear in ascending order, where   is a whole number greater than 0 (zero).</li>  : Use this variable to define a range of events in each log, where  and   are whole numbers greater than 0 (zero).</li></ul> </li> -format table|list| csv: Use this parameter to specify the output format. If you omit this parameter, Eventquery.pl uses the table format.</li> -v: Use this parameter to add the event Data and Description sections to the display.</li> -filter  [-filter ...]: Use this parameter to specify the criteria for events that are included in the display. If you omit this parameter, all events appear. Use a separate instance of -filter for each criteria that you want to specify, and separate each parameter with a space.

The following table lists the operators and values that are available for each field that is used with the -filter parameter. The table also provides an example of each :</li></ul>

back to the top

Examples
 To display all events in the Application log of the local computer in the default table format, type the following line at the command prompt, and then press ENTER:

eventquery.pl application

</li> To display details of all events in the System and DNS Server logs of a computer named Server8 in list format, type the following line at the command prompt, and then press ENTER:

eventquery.pl system &quot;dns server&quot; -s server8 -format list -v

</li> To run Eventquery.pl by using the Administrators account to display the events in the Security log of a computer named Server5 in comma-delimited format and redirect the output to a file named Srv5_Sec.csv on drive E, type the following line at the command prompt, and then press ENTER:

eventquery.pl security -s server5 -u \administrator -p   -format csv > e:\srv5_sec.csv

</li> To display a detailed record of events in all event logs of the local computer that were recorded between 8:00 A.M and 8:20 A.M. on February 8, 2002, in list format, type the following line at the command prompt, and then press ENTER:

eventquery.pl * -format list -v -filter &quot;datetime>02/08/2002:8:00am&quot; -filter &quot;datetime<02/08/2002:08:20am&quot;

</li> To search the System log for instances of Windows File Protection Event ID 64004 and then display the events in default table format, type the following line at the command prompt, and then press ENTER:

eventquery.pl system -filter &quot;source=windows file protection&quot; -filter &quot;id=64004&quot; -v

</li> To display the five most recent events from the Application log on a computer named Server8 in the default table format and redirect the output to the App_new.txt file, type the following line at the command prompt, and then press ENTER:

eventquery.pl application -s server8 -range 5 > app_new.txt

</li> To display all error events (except Event ID 100) that are recorded in the Application log by a program named MyApp in comma-delimited format and redirect the output to the C:\Myapp\Errors.csv file, type the following line at the command prompt, and then press ENTER:

eventquery.pl application -filter &quot;type=error&quot; -filter &quot;source=myapp&quot; -filter &quot;id!100&quot; -format csv > c:\myapp\errors.csv

</li></ul>

back to the top

Troubleshooting
When you try to run Eventquery.pl, you receive the following error message:

ERROR: Wmi.pm is required to run the script.

Copy Wmi.pm from the Resource Kit directory to /Perl/site/lib/W2RK.

This behavior can occur if the computer is not correctly configured to run the Perl scripts that are included in the Windows 2000 Resource Kit Supplement 1. To use Eventquery.pl, the W2rk folder must exist in the \Site\Lib folder, and it must contain the Wmi.pmi file.

To resolve this behavior, manually configure the environment in which to run Perl scripts:
 * 1) Create a folder named W2rk in the  \Site\Lib folder.

NOTE: The default  is  :\Perl where   is the drive on which Windows is installed.
 * 1) Copy the Wmi.pmi file from the folder in which the Windows 2000 Resource Kit is installed (typically, \Program Files\Resource Kit) to the W2rk folder that you created in step 1.

When you run Eventquery.pl, you may receive one or more messages similar to the following in the Command Prompt window:

INFO: No ' ' log entries satisfy filter criteria.

This behavior may occur if Eventquery.pl did not find any event log entries that meet the filtering criteria that you specified.

back to the top

<div class="references_section">