Windows log files find eligible columns and count

Source: Internet
Author: User

Because you want to count the number of times Windows fails to log on every day,

"Wevtutil el"//list log names

"Wevtutil GL Journal name"//Get log configuration information.

You can use short (such as Ep/uni) or long (such as Enum-publishers/unicode) in the form of commands and option names.

commands, options, and option values are not case-sensitive.

Variables are capitalized.

wevtutil COMMAND [ARGUMENT [ARGUMENT] ...] [/option:value [/opt

Command:

El | Enum-logs lists the journal names.

GL | Get-log Gets the log configuration information.

SL | Set-log Modify the log configuration.

EP | Enum-publishers Lists event Publishers.

GP | Get-publisher Gets the publisher configuration information.

im | Install-manifest Install event Publishers and logs from the list.

Um | Uninstall-manifest unload the event Publisher and log from the list.

QE | Query-events queries the event from the log or log file.

Gli | Get-log-info Gets the log status information.

EPL | Export-log Export the log.

Al | Archive-log Archive the exported logs.

CL | Clear-log clears the log.



Export log files to text format first wevtutil QE Security > C:\log.txt

Log file%systemroot%\system32\winevt\logs\security.evtx

Find the Login failure number "0XC000006D" Login failure code for one day

find/n "2016-12-06" Log.txt | Find/c "0XC000006D"


Find common methods

Find "ABC" D:\test.txt, which indicates that all rows containing the string bathome are found in the text file Test.txt under the D-Packing directory.

find/i "ABC" test.txt means case insensitive

find/v "ABC" test.txt, which indicates that rows that do not contain the string ABC are found (ABC is case-sensitive), and if the case of ABC is not distinguished, it should be written as find/i/V "ABC" test.txt.

FIND/C "abc" test.txt. To count rows that contain a string

find/n "ABC" test.txt line number at the beginning of each line,


This article is from the "Heaven Destruction" blog, please make sure to keep this source http://455073134.blog.51cto.com/3461083/1882713

Windows log files find eligible columns and count

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.