A. The Windows 2000 Server Resource Kit includes the elogdmp.exe utility, which lets you display the contents of a particular type of log file. Valid event log types are

  • Application
  • Directory Service (if the system is a domain controller--DC)
  • DNS Server (if the system is a DNS server)
  • File Replication Service (FRS--if the system is a server)
  • Security
  • System

To use the Elogdmp command, go to the command prompt and type

elogdmp \\<machine> <log type>

To dump the event log files for the local machine, type

elogdmp \\. <log type>

The Elogdmp output is comma-delimited (you can output the information to a file by adding "> filename.txt" without the quotes to the end of the command), so applications such as Microsoft Excel can easily read the information. The following text shows an example of Elogdmp output:

"07/17/2002","13:59:05","EventLog","INFO","None",6009,"N/A","TITANIC2K","5.0/2195/Service Pack 2/Uniprocessor Free/"

Windows XP users can use eventquery.vbs, which ships with the OS, to dump event logs from the command line.