LinkedInTwitterFacebook

Using wevtutil command under Windows – part 001.

This command let you to retrieve information about event logs and publishers, to install and uninstall event manifests,run queries, and to export, archive, and clear logs.
I will start with simple examples to see how is working.
First you need to know the events can be see also with windows tool named Event Viewer.
This tool can be found with Control Panel – search Event.
Take a look at Windows Logs – Application. Can you see some logs is created to told us how is working.
For today I will deal with this part. The sintax of this command:
wevtutil [{el | enum-logs}] [{gl | get-log} [/f:]]
[{sl | set-log} [/e:] [/i:] [/lfn:] [/rt:] [/ab:] [/ms:] [/l:] [/k:] [/ca:] [/c:]]
[{ep | enum-publishers}]
[{gp | get-publisher} [/ge:] [/gm:] [/f:]] [{im | install-manifest} ]
[{um | uninstall-manifest} ] [{qe | query-events} [/lf:] [/sq:] [/q:] [/bm:] [/sbm:] [/rd:] [/f:] [/l:] [/c:] [/e:]]
[{gli | get-loginfo} [/lf:]]
[{epl | export-log} [/lf:] [/sq:] [/q:] [/ow:]]
[{al | archive-log} [/l:]]
[{cl | clear-log} [/bu:]] [/r:] [/u:] [/p:] [/a:] [/uni:]

Let’s start:
– show us the four most recent events from the Application log in textual format:
wevtutil qe Application /c:4 /rd:true /f:text
– display the status of the Application log:
wevtutil gli Application
– save logs to C:\backups\today.evtx and clear all of the events from the Application log:
wevtutil cl Application /bu:C:\backups\today.evtx
– show the configuration information about the Application log on the local computer in XML format:
wevtutil gl Application /f:xml
I will come with many example of this command. Thank you.

Share