Windows sysinternals

Chapter 6 Pstools 193
PsLogList does not require administrative rights to display records from the local Application
or System logs or from a saved *.evt file, or to export the Application or System logs to
an *.evt file. Administrative rights might not be needed to view the Application log of a
remote Windows XP computer, but event text will not be accessible. Administrative rights
are required to clear event logs or to access the local Security log or any other remote
event logs.
The rest of PsLogList’s command-line options are summarized in Table 6-2 and are discussed
in more detail in the rest of this section.
TABLE 6-2 PsLogList Command-Line Options
Option
Output options
Description
–x Displays extended data if that is present. (It’s not applicable if –s used.)
–n # Limits the number of records displayed to the specified number.
–r Reverses the order—displays oldest to newest (with default being newest to
oldest).
–s Displays each record on one line with delimited fields.
–t char Specifies the delimiter character to use with –s. Use \t to specify Tab.
–w Waits for new events, displaying them as they are generated. PsLogList runs
until you press Ctrl+C. (Local computer only.)
Timestamp options
–a mm/dd/yyyy Displays records time-stamped on or after the date mm/dd/yyyy.
–b mm/dd/yyyy Displays records time-stamped before the date mm/dd/yyyy.
–d # Displays only records from the previous # days.
–h # Displays only records from the previous # hours.
–m # Displays only records from the previous # minutes.
Event content filtering options
–f filter Filters event types, where each letter in filter represents an event type.
–i ID[,ID,…] Shows only events with the specified ID or IDs (up to 10).
–e ID[,ID,…] Shows events excluding those with the specified ID or IDs (up to 10).
–o source[,source,…] Shows only events from the specified event source or sources. The * character
can be appended for a substring match.
–q source[,source,…] Shows events excluding the specified event source or sources. The * character
can be appended for a substring match.
Log-management options
–z Lists event logs registered on the target system.
–c Clears the event log after displaying records.
–g filename Exports an event log to a *.evt file. (Local computer only.)
–l filename Displays records from a saved *.evt file instead of from an active log.
www.it-ebooks.info