PsLogList

The PsLogList application was developed to be a small command line tool that will show the contents of the System Event Log on the local computer, with visually-friendly formatting of Event Log records. Command line options let you view logs on different computers, use a different account to view a log, or to have the output formatted in a string-search friendly way.

Usage:

psloglist [-?] [\computer[,computer[,...] | @file [-u username [-p password]]] [-s [-t delimiter]] [-m #|-n #|-h #|-d #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy][-f filter] [-i ID[,ID[,...] | -e ID[,ID[,...]]] [-o event source[,event source][,..]]] [-q event source[,event source][,..]]] [-l event log file]
@file
Execute the command on each of the computers listed in the file.
-a
Dump records timestamped after specified date.
-b
Dump records timestamped before specified date.
-c
Clear the event log after displaying.
-d
Only display records from previous n days.
-e
Exclude events with the specified ID or IDs (up to 10).
-f
Filter event types with filter string (e.g. "-f w" to filter warnings).
-h
Only display records from previous n hours.
-i
Show only events with the specified ID or IDs (up to 10).
-l
Dump records from the specified event log file.
-m
Only display records from previous n minutes.
-n
Only display the number of most recent entries specified.
-o
Show only records from the specified event source (e.g. "-o cdrom").
-p
Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.
-q
Omit records from the specified event source or sources (e.g. "-q cdrom").
-r
Dump log from least recent to most recent.
-s
This switch has PsLogList print Event Log records one-per-line, with comma delimited fields. This format is convenient for text searches, e.g. psloglist | findstr /i text, and for importing the output into a spreadsheet.
-t
The default delimeter is a comma, but can be overriden with the specified character.
-u
Specifies optional user name for login to remote computer.
-w
Wait for new events, dumping them as they generate (local system only).
-x
Dump extended data.
eventlog