anachrom Цитата: psloglist
/? | more
см. последний абзац прям для тебя
[more]
Usage: psloglist [\\computer[,computer2[,...] | @file] [-u username [-p password]]] [-s [-t delimiter]] [-m #|-n #|-d #|-h #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy] [-f filter] [-i ID,[ID,...]] | -e ID,[ID,...]] [-o event source[,event source[,...]]] [-q event source[,event source[,...]]] [[-g|-l] event log file] <event log>
@file Psloglist will execute the command on each of the computers
listed in the file.
-a Dump records timestamped after specified date.
-b Dump records timestamped before specified date.
-c Clear event log after displaying.
-d Only display records from previous n days.
-e Exclude events with the specified ID or IDs (up to 10).
Append '*' to specify substring match.
-f Filter event types, using starting letter
(e.g. "-f we" to filter warnings and errors).
-g Export an event log as an evt file. This can only be used
with the -c switch (clear log).
-h Only display records from previous n hours.
-i Show only events with the specified ID or IDs (up to 10).
-l Dump the contents of the specified saved event log file.
-m Only display records from previous n minutes.
-n Only display n most recent records.
-o Show only records from the specified event source or sources
(e.g. "-o cdrom"). Append '*' to specify substring match.
-p Specifies password for user name.
-q Omit records from the specified event source or sources
(e.g. "-q cdrom").
-r Dump log from least recent to most recent.
-s Records are listed on one line each with delimited
fields, which is convenient for string searches.
-t The default delimiter for the -s option is a comma,
but can be overriden with the specified character. Use "\t"
to specify tab.
-u Specifies optional user name for login to
remote computer.
-w Wait for new events, dumping them as they generate (local system
only.)
-x Dump extended data.
eventlog Specifies event log to dump. Default is system. If the
-l switch is present then the event log name specifies
how to interpret the event log file.
[/more]
