computer The computer on which the log resides. Default=local
system
-p
passwd Specify a password for
user (optional).
Passed as clear
text.
If omitted, you will be prompted to enter a hidden
password.
-u
user Specify a user
name for login to remote
computer(optional).
@file Execute the command on each of the computers listed in
the file.
-a Dump records timestamped after specified date.
-b Dump records timestamped before specified date.
-c Clear the event log after displaying.
-d # Only display records from previous # days.
-e
ID Exclude events with the specified ID or IDs (up to 10).
-f
filter Filter event types with filter string (e.g. "-f w" to
filter warnings).
-h # Only display records from previous # hours.
-i
ID Show only
events with the specified ID or
IDs (up to 10).
-l
event_log_file Dump records from the specified event log file.
-m # Only display records from previous
# minutes.
-n # Only display # number of most recent entries.
-o
event source
Show only records from the specified event source (e.g.
\"-o cdrom\").
-q
event source
Omit records from the specified
event source or sources
(e.g. \"-q cdrom\").
-r Dump log from least recent to most recent.
-s Print Event Log records one-per-line, with comma
delimited fields.
This format is
convenient for text searches, e.g.
psloglist | findstr /i text
and for importing the output into a spreadsheet.
-t
delim The default delimeter is a comma, but can be overriden
with the specified character.
-w
Wait for new events, dumping them as they generate (local
system only).
-x Dump extended data.
eventlog application,
system or security, only the first few
letters need be used.
default=system log.
If your current security credentials would not permit access
to the Event Log, specify a different
username ( -u user ).
Chia sẻ với bạn bè của bạn: