Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format.

The print server runs Win2008R2. When I want to export the filtered log to XML (I have filtered event ID 307) I've got only 300 events from almost 6000.

Could you help me? I have also tried powershell to export the log, but I'am not able to get the xml structure.

share|improve this question

The windows utility wevtutil can do just what you're looking for. I was using it for archiving certain event-log entries into a database. The powershell based methods had several failure-modes that made iterating over a large number of events infeasible. This utility dumps the entire thing in one go, which makes offline parsing much, much faster.

wevtutil qe Security /r:DC01 /q:"*[System[((EventID=307))]]" > evtdump.xml

Specifically, the powershell methods pull events on a retail basis. As it iterates through the loop it's asking the target machine "give me the next event", which requires a lot of back-and-forth to the machine. The speed difference between the wevutil method and the powershell method was significant: it took over an hour to extract an event-log via powershell, but only 2 minutes via wevtutil.

Depends on your use-case though. If the logs you're parsing are not busy or not very large, the powershell method means you don't have to manage files as part of your script.

share|improve this answer
Thanks! that is exactly what i am looking for, – user1169051 Jan 25 '12 at 12:26

This should do the trick:

Get-WinEvent | ?{$ -eq 307} | Export-Clixml 307Events.xml  
share|improve this answer
but if i use this powershell script the xml file has not the windows event xml structure and so it is not easy to parse it – user1169051 Jan 25 '12 at 12:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.