A. The Windows 2000 Server Resource Kit includes the elogdmp.exe utility, which lets you display the contents of a particular type of log file. Valid event log types are
- Directory Service (if the system is a domain controller--DC)
- DNS Server (if the system is a DNS server)
- File Replication Service (FRS--if the system is a server)
To use the Elogdmp command, go to the command prompt and type
elogdmp \\<machine> <log type>
To dump the event log files for the local machine, type
elogdmp \\. <log type>
The Elogdmp output is comma-delimited (you can output the information to a file by adding "> filename.txt" without the quotes to the end of the command), so applications such as Microsoft Excel can easily read the information. The following text shows an example of Elogdmp output:
"07/17/2002","13:59:05","EventLog","INFO","None",6009,"N/A","TITANIC2K","5.0/2195/Service Pack 2/Uniprocessor Free/"
Windows XP users can use eventquery.vbs, which ships with the OS, to dump event logs from the command line.