Executive Summary:
The Windows Event Viewer is a tool that can provide you with useful information regarding your computer's health. Although many events are logged in the Windows Event Viewer, it's sometimes useful to create and log custom events. Using the Windows Eventcreate command, you can easily create and log custom events.
|
The Windows Event Viewer is a tool
that can provide you with useful information regarding your computer's
health. It contains at least three logs:
the Application log (which contains
events generated by applications),
the Security log (which contains
security-related events generated by
Windows), and the System log (which
contains system-wide events generated
by Windows). Each log displays Information, Warning, and Error events,
which are accompanied by the name
of the source component that raised
the event, a brief event description,
and an event ID. Administrators rely
on these logs not only for information
about problems (e.g., failure to start
a service) but also for information
about successful operations (e.g., successful RAS connections).
Sometimes it's useful to log your
own events. For example, I have a
startup script that I've scheduled to
run every night. I recently found a
way to log its events so that I could
make sure it was successfully executing. You can log events by using the
Eventcreate command. The basic
syntax that I use is:
Eventcreate /ID EventID
/L LogName /T Type
/SO Source /D Description
where
- EventID is the ID you want to give
the event. You can use any number
from 1 to 1000.
- LogName is the name of the log to
which you want to write the event.
You can write to the Application or
System log but not the Security log.
- Type defines the severity of the
event. You can specify Information,
Warning, or Error.
- Source specifies the component (e.g., application, script) generating
the event.
- Description is the text you want displayed when the event appears in
the log.
For example, I created the following event to be logged whenever my
startup script successfully executes.
Note that this command has to be
entered inside the startup script:
Eventcreate /ID 123
/L Application /T Information
/SO StartupScript
/D "Startup script executed!"
You can even write events to a log
on another computer by using the
eventcreate command's /S Computer
parameter (where Computer is the
machine's name). If you need to
specify alternate credentials for the remote-computer, you can use the /U User and
/P Password parameters (where User and
Password are the credentials). For information about these three parameters, open a command prompt and type
eventcreate /?
The Eventcreate
command works on
Windows Server 2003
and Windows XP. I
haven't tested it on any
other OSs.