Windows log files find eligible columns and count

Because you want to count the number of times Windows fails to log on every day,

"Wevtutil el"//list log names

"Wevtutil GL Journal name"//Get log configuration information.

You can use short (such as Ep/uni) or long (such as Enum-publishers/unicode) in the form of commands and option names.

commands, options, and option values are not case-sensitive.

Variables are capitalized.

wevtutil COMMAND [ARGUMENT [ARGUMENT] ...] [/option:value [/opt

Command:

El | Enum-logs lists the journal names.

GL | Get-log Gets the log configuration information.

SL | Set-log Modify the log configuration.

EP | Enum-publishers Lists event Publishers.

GP | Get-publisher Gets the publisher configuration information.

im | Install-manifest Install event Publishers and logs from the list.

Um | Uninstall-manifest unload the event Publisher and log from the list.

QE | Query-events queries the event from the log or log file.

Gli | Get-log-info Gets the log status information.

EPL | Export-log Export the log.

Al | Archive-log Archive the exported logs.

CL | Clear-log clears the log.

Export log files to text format first wevtutil QE Security > C:\log.txt

Log file%systemroot%\system32\winevt\logs\security.evtx

Find the Login failure number "0XC000006D" Login failure code for one day

find/n "2016-12-06" Log.txt | Find/c "0XC000006D"

Find common methods

Find "ABC" D:\test.txt, which indicates that all rows containing the string bathome are found in the text file Test.txt under the D-Packing directory.

find/i "ABC" test.txt means case insensitive

find/v "ABC" test.txt, which indicates that rows that do not contain the string ABC are found (ABC is case-sensitive), and if the case of ABC is not distinguished, it should be written as find/i/V "ABC" test.txt.

FIND/C "abc" test.txt. To count rows that contain a string

find/n "ABC" test.txt line number at the beginning of each line,

This article is from the "Trust Yourself" blog, please be sure to keep this source http://455073134.blog.51cto.com/12366638/1880053

Windows log files find eligible columns and count