Protocolling Windows-Logins with logParser

Question

I would like to protocoll all windows logins with logparser. Everything works fine for Application or System but not in Security.

The script looks like this:

"C:\Program Files (x86)\Log Parser 2.2"\logparser.exe -i:EVT -o:TPL -tpl:"C:\scripts\CheckServices\Logparser.tpl" "SELECT TimeGenerated,EventID,EventType,EventTypeName,EventCategory,EventCategoryName,SourceName,Strings,ComputerName,SID,Message FROM \\127.0.0.1\Security WHERE TimeGenerated > TO_TIMESTAMP(SUB(TO_INT(TO_LOCALTIME(SYSTEM_TIMESTAMP())),1200)) AND EventType IN (1;2) ORDER BY TimeGenerated DESC" -q:ON -stats:OFF >> c:\temp\failed.html

(Timeframe of 1200 was done intentionally as we run the script in that cycle)

I would like to get two files:

• failed.html with all failed logins
• all.html with all logins

How can I achieve this?

Answer 1

Are you sure you really want to filter by EventType and not EventID?
EventType 1=Error, 2=Warning, which exist in other logs, but not the security log.
Security log will only contain types: 8=Successs, 16=Failure.
https://msdn.microsoft.com/en-us/library/ms813548.aspx

Answer 2

Difficult to state exactly why it's not working without an error message or problem description. Clayton is probably the right answer, but you will also want to make sure that your the environment which launches your script/task/etc. has sufficient privileges to access the security log, since it requires a higher level of privileges.

Finally, unless you a big fan of scripting, I would also recommend potentially looking into an event log product which should be able to do the same thing in real time. For example, EventSentry Light (completely free, no registration) can write events to a text file in real time.