You should have a look at LogParser utility. LogParser was written by a Microsoft employee in his spare time. It's an .exe that can run as a standalone utility without requiring "installation". It will even run when executed from a remote location such as
\\server\share\logparser.exe or from within a remote RDP session as
LogParser uses an SQL-like syntax to query Windows event logs -- even remotely! It can report results as nicely formatted .txt, .csv, .xml or even graphic charts output. (It can do much more than just query event logs, but this is what you need right now...). Try it:
logparser.exe -h examples
This will give you a few examples about what you can do with it. The next line will output the first 5 (oldest 5) events from the 'Application' eventlog of your own workstation:
logparser.exe "SELECT TOP 5 * FROM \\.\application"
The next query will output the top 20 events from 3 different eventlogs on 3 different servers:
- 'Application' eventlog of remoteserver1 and
- 'System' eventlog of remote2.
- 'Security' eventlog of local system.
Try it (but write the following all in one line):
"SELECT TOP 20 *
FROM \\remoteserver1\Application, \\remote2\System,\\.\Security
ORDER by TimeGenerated DESC"
It will output the query results as a list in your cmd.exe window, in descending order. By default it will prompt you after 10 lines for more output. Oh, and the commandline params aren't even case sensitive, in case you like all lower casing better for faster typing. Here is something that may help your current needs. Again, type it in one line:
"select top 50
timegenerated as logondate,
extract_token(message, 0, ':') as logevent,
extract_token(strings, 0, '|') as username,
extract_token(strings, 1, '|') as domain
where eventid not in (541;542;543)
and eventtype = 8
and eventcategory = 2 order by timegenerated desc"
-rtp:-1 if you want to override the defaualt value of
10 for rows to process, so you
are not prompted for more output every 10 lines.
It will be easy to put a fitting log parser query into a batch file
LastLogins.bat and store that somewhere in your
- I have not really tested the above queries; you may need to tweak them for your own purpose.
- In the past I have used LogParser heavily on Windows XP and Windows 2003 Server, where it worked well. But I have no experience whatsoever on Vista or Windows 7 with it.
- PowerShell and the
wmic.exe utility will be able to achieve similar things. It's just that logparser is my own preference for jobs like that.