Filter EventLog

[dolphins]

Hi,

in C# I can set a filter when I read the Event log. Example:

I only want the Errors from the application Event log, the SourceName should be "MyApp", the CategoryString should be "whatever" and TimeGenerated should be >= "some dateTime" (that is possible in C#).

Is there a way to do that in AutoIt, other than read the whole log and filter every single record with "if" statements?

Thanks in advance

dolphins

[JLogan3o13]

You can query with the built in Windows wevtutil utility and the qe switch to filter events.

[Spider001]

Other option

'?do=embed' frameborder='0' data-embedContent>>

[orbs]

the WMI way - adapt this to your needs:

'?do=embed' frameborder='0' data-embedContent>>

[dolphins]

Thanks everybody for the answers.

@Spider001

Since there is no .NET installed on the Server (and it is not allowed to install it for security reasons), I am not going for this way.

@orbs

I am using WMI in C# to read the Event log from the Client. Unfortunately since Windows Server 2008 you must use the user "Administrator" to use WMI. On Windows Server 2003 it was enough to use a user that is in the Administrator Group. At least this is when you connect with WMI from a Client to a Server. Not sure if you run WMI directly on the Server !?

@JLogan3o13

I didn't know about that tool. I will give it a try! Thanks

[dolphins]

I just tried the solution suggested by @orbs. It works fine on a Windows Server 2012 with a user of the Administrator Group (I did start the AutoIt-program on the Server). Thanks again!