Windows Server

Create event log entries in Windows Server 2003

When performing automated tasks on remote systems, recording the automated tasks to the event logs can help you or other administrators understand what actions you performed and how the system responded. You may find log entries especially useful for recording other events to the log by using the Windows Server 2003's command line utility. Derek Schauland shows how you can issue this utility within a batch file to record the actions of the batch file or call upon it during an installation to an event log.

Windows Server 2003 logs many types of events for all sorts of events, including applications, system events, and security items. These event logs are helpful in tracking down performance issues and problems with the operating system or applications running on the server. You may find log entries especially useful for recording other events to the log by using the Windows Server 2003's command line utility. You can issue this utility within a batch file to record the actions of the batch file or call upon it during an installation to an event log.

The Event Create command for creating an event log entry is EventCreate. Executing the EventCreate command with the /? argument provides the commands shown in the table below.

C:> eventcreate /S \\servername /L Application /T Success /SO Application Name /ID 1754 /D "Description of event"

You can record any event to the logs with this command. Windows Server 2003 adds many events to the logs without user intervention, but any custom scripts you create to assist you in performing any tasks may not remain recorded on your system unless you record them.

Argument Action
/S Specify the name of the remote system to connect to when recording the event
/U Specify a username to record the event as necessary
/P Specify a password for the given username; Prompts for input when a password is not specified.
/L Specify the log to record the event (e.g., Application, System, Security)
/T Specify the type of event; valid types include SUCCESS, ERROR, WARNING, INFORMATION
/SO Specify the source of the event (e.g., WinWord for Microsoft Word)
/ID Specify an ID for the event between 1 and 1000 (no commas accepted)
/D Specifies the description of the event to be entered; it requires surrounding quotation marks

When performing automated tasks on remote systems, recording the automated tasks to the event logs can help you or other administrators understand what actions you performed and how the system responded.

Note: The EventCreate command also works on Windows XP and Vista systems.

Miss a Windows Server 2003 tip?

Check out the Windows Server 2003 archive, and catch up on the most useful tips from this newsletter.

Stay on top of the latest Windows Server 2003 tips and tricks with our free Windows Server newsletter, delivered each Wednesday. Automatically sign up today!

About

Derek Schauland has been tinkering with Windows systems since 1997. He has supported Windows NT 4, worked phone support for an ISP, and is currently the IT Manager for a manufacturing company in Wisconsin.

6 comments
sreedarbabu
sreedarbabu

Thanks Derek Schauland, Its wonderfull

painapur
painapur

Hi This is Priya. I am trying to use eventcreate command on microsoft vista, as shown below: c:\>eventcreate /t error /id 1000 /l application /d "example text line" but this command line give error as shown below: ERROR: Access is denied. Can you please help me out in resolving this problem. Thanks Priya

laman
laman

I am sure that I have seen this one long time ago. John, I have a feeling that you are looking into all these command line tools and create all these articles recently. Please be more creative and thoughtful.

kserritt
kserritt

This will be very useful for the batch files I have created. I was not aware that you could do this. In testing though I don't believe "Success" is a valid /T command.

Jim_P
Jim_P

Hi, I have noticed a lot of those commands in that help page don't exist. I assume they come in the support tools pack. But that's a great reference page. Kind Regards, Jim