8

I was looking for either a batch file, powerscript (not really good with yet)or any way to have my event logs exported to txt or csv on every start up? Im using windows 7 pro if that helps

ShaadShaad
  • 117
  • 1
  • 1
  • 6

2 Answers2

15

This will output last 20 system event logs in eventlog.txt.Not sure what exactly you need from eventlog - it's a big place... 

WEVTUtil query-events System /count:20 /rd:true /format:text > eventlog.txt

You can change System to Application,Security or Setup - not sure what exactly you need.

more info: http://ss64.com/nt/wevtutil.html

check also this: http://ss64.com/nt/psloglist.html

You can save this (or similar) command to bat file and schedule it on start-up

npocmaka
  • 55,367
  • 18
  • 148
  • 187
  • That worked now 1 more question (maybe) would I switch out "system" for the security and application events? Or can I have all 3 in the same script? *I am pretty new to this* – ShaadShaad Sep 09 '14 at 20:08
  • I need the crash logs to export. That's probably what I should have said from the beginning. Also is there a symbol or number I could use if I needed all and not just 20? – ShaadShaad Sep 09 '14 at 20:12
  • @user310473 - according to the command help you can have only one of the events roots (System,Application,...) But you can create a batch with 3 lines to export all then.And you can search trough the created files with `FIND` or `FINDSTR` command – npocmaka Sep 09 '14 at 20:18
  • ok that worked great, but when I change "system" to "security" or "applications" the text file is blank, but in my event viewer it shows information. I also cant seem to figure out how to export the crash logs part. thanks for your help! – ShaadShaad Sep 10 '14 at 01:29
  • Any idea how to export to CSV? /format:Text produces a bunch of lines per event. However, the gui of EventVwr allows to save to csv. Note: Couldn't find a suitable documented csv option. TIA. – Serge Wautier Mar 23 '20 at 11:33
  • 1
    @SergeWautier - the only supported formats are XML and Text. Probably you can use the XML format and transform it to CSV with some other tool? – npocmaka Mar 24 '20 at 10:03
2
WEVTUtil query-events System /count:20 /rd:true /format:text > exported_file_name.csv /q:"Event[System[(EventID=1074)]]"

Then gpedit.msc - windows settings - scripts and add to start up. Thanks @npockmaka for getting this started

ShaadShaad
  • 117
  • 1
  • 1
  • 6