PsLogList (List Event Logs) Action

PsLogList allows you to print a filtered section of a Windows Event Log. For full details, see the PsLogList help topic inside PsTools help.

Events to List

Specify the name of an event log to list. The name can be a Windows event log (ie Application, Security or System), or an application-created Event Log which is viewable in the Windows Event Viewer administration tool.

List Errors / Warnings / Information / Success Audits / Failure Audits

Specify the types of log messages you wish to be printed.

Event IDs

You can choose to show all Event IDs, or filter the events by ID. Filtering can either include or exclude the specified IDs. Enter up to 10 IDs in the event IDs field, separated by commas.

Event Sources

Similar to the Event IDs section, you can choose to show events from all sources, or filter events by specific sources (included or excluded.) Specify up to 10 event sources, separated by commas.

Time Range

You can choose to only log events within a certain date range, or within a certain period in the past.

Output Order

You can choose to list events from the newest to the oldest, or the other way around.

Show one line per record (-s) with Delimiter (-t)

Outputs the event data in "machine readable" delimited field format (default is comma-delimited.)

Clear event log after displaying (-c)

If this option is selected, all of the entries which are selected will be removed from the log.

Export to .evt file (-g)

Enter the path to an .evt file to export the event data as it is removed.

Log extended data (-x)

Check this option to view extended information about each log entry.

Log event data to variable

Check this option to write the log data to a variable. This can be used in conjunction with the "Show one line per record" option to create a table of machine-readable event data which can be parsed by a script.

"Remote" Tab

See the PsTools Common Options topic.