How to get multiple path in wevtutil? Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) Come Celebrate our 10 Year Anniversary!Useful Command-line Commands on WindowsHow do I fix a custom Event Viewer Log that merges automatically with the Application log?Is ETW available in Windows Server 2003?Unknown and strange RDP successful logins in EventViewerRemote Desktop Services login historyI need an XPath query to view all events in the Windows event log (custom view)Change an Applications and Services Logs log path using GPOForwarded events not showing file path on event collectorHow to display more Task Scheduler logs?What is RDSAppXPlugin?
What makes black pepper strong or mild?
How do I stop a creek from eroding my steep embankment?
What is the longest distance a 13th-level monk can jump while attacking on the same turn?
What are the motives behind Cersei's orders given to Bronn?
Is a manifold-with-boundary with given interior and non-empty boundary essentially unique?
Marking the functions of a sentence: 'She may like it'
3 doors, three guards, one stone
How can players work together to take actions that are otherwise impossible?
Are variable time comparisons always a security risk in cryptography code?
Area of a 2D convex hull
How to recreate this effect in Photoshop?
How does cp -a work
What does '1 unit of lemon juice' mean in a grandma's drink recipe?
Does the Giant Rocktopus have a Swim Speed?
List numbering with letters
Is there a documented rationale why the House Ways and Means chairman can demand tax info?
Precipitating silver(I) salts from the solution of barium(II) cyanate and iodide
How is the internal pullup resistor in a microcontroller wired?
Withdrew £2800, but only £2000 shows as withdrawn on online banking; what are my obligations?
What are 'alternative tunings' of a guitar and why would you use them? Doesn't it make it more difficult to play?
Can a non-EU citizen traveling with me come with me through the EU passport line?
Can a drone be seen on TCAS?
How to assign captions for two tables in LaTeX?
Sorting numerically
How to get multiple path in wevtutil?
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern)
Come Celebrate our 10 Year Anniversary!Useful Command-line Commands on WindowsHow do I fix a custom Event Viewer Log that merges automatically with the Application log?Is ETW available in Windows Server 2003?Unknown and strange RDP successful logins in EventViewerRemote Desktop Services login historyI need an XPath query to view all events in the Windows event log (custom view)Change an Applications and Services Logs log path using GPOForwarded events not showing file path on event collectorHow to display more Task Scheduler logs?What is RDSAppXPlugin?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
0
In Event Viewer I have this Custom View:
<QueryList>
<Query Id="0" Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">
<Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*[System[(EventID=1149 or EventID=21 or EventID=42 or EventID=25 or EventID=24) and TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*[System[(EventID=1149 or EventID=21 or EventID=42 or EventID=25 or EventID=24) and TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
How correctly should this look in wevtutil?
The best what I get is this:
wevtutil qe Microsoft-Windows-TerminalServices-LocalSessionManager/Operational /q:"*[System[EventID=21 or EventID=25 or EventID=24 or EventID=42] and System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text > c:log.txt
&&
wevtutil qe Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational /q:"*[System[EventID=1149] and System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text >> c:log.txt
The question is how to properly use two paths?
windows-server-2012-r2 windows-command-prompt eventviewer wevtutil
asked Apr 10 at 13:01
AdamAdam
1
New contributor
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
0
In Event Viewer I have this Custom View:
<QueryList>
<Query Id="0" Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">
<Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*[System[(EventID=1149 or EventID=21 or EventID=42 or EventID=25 or EventID=24) and TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*[System[(EventID=1149 or EventID=21 or EventID=42 or EventID=25 or EventID=24) and TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
How correctly should this look in wevtutil?
The best what I get is this:
wevtutil qe Microsoft-Windows-TerminalServices-LocalSessionManager/Operational /q:"*[System[EventID=21 or EventID=25 or EventID=24 or EventID=42] and System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text > c:log.txt
&&
wevtutil qe Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational /q:"*[System[EventID=1149] and System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text >> c:log.txt
The question is how to properly use two paths?
windows-server-2012-r2 windows-command-prompt eventviewer wevtutil
asked Apr 10 at 13:01
AdamAdam
1
New contributor
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
0
0
0
In Event Viewer I have this Custom View:
<QueryList>
<Query Id="0" Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">
<Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*[System[(EventID=1149 or EventID=21 or EventID=42 or EventID=25 or EventID=24) and TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*[System[(EventID=1149 or EventID=21 or EventID=42 or EventID=25 or EventID=24) and TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
How correctly should this look in wevtutil?
The best what I get is this:
wevtutil qe Microsoft-Windows-TerminalServices-LocalSessionManager/Operational /q:"*[System[EventID=21 or EventID=25 or EventID=24 or EventID=42] and System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text > c:log.txt
&&
wevtutil qe Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational /q:"*[System[EventID=1149] and System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text >> c:log.txt
The question is how to properly use two paths?
windows-server-2012-r2 windows-command-prompt eventviewer wevtutil
asked Apr 10 at 13:01
AdamAdam
1
New contributor
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
In Event Viewer I have this Custom View:
<QueryList>
<Query Id="0" Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">
<Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Operational">*[System[(EventID=1149 or EventID=21 or EventID=42 or EventID=25 or EventID=24) and TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
<Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational">*[System[(EventID=1149 or EventID=21 or EventID=42 or EventID=25 or EventID=24) and TimeCreated[timediff(@SystemTime) <= 86400000]]]</Select>
</Query>
</QueryList>
How correctly should this look in wevtutil?
The best what I get is this:
wevtutil qe Microsoft-Windows-TerminalServices-LocalSessionManager/Operational /q:"*[System[EventID=21 or EventID=25 or EventID=24 or EventID=42] and System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text > c:log.txt
&&
wevtutil qe Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational /q:"*[System[EventID=1149] and System[TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text >> c:log.txt
The question is how to properly use two paths?
windows-server-2012-r2 windows-command-prompt eventviewer wevtutil
windows-server-2012-r2 windows-command-prompt eventviewer wevtutil
asked Apr 10 at 13:01
AdamAdam
1
New contributor
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 10 at 13:01
AdamAdam
1
New contributor
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 10 at 13:01
AdamAdam
1
New contributor
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 10 at 13:01
AdamAdam
1
asked Apr 10 at 13:01
AdamAdam
1
1
New contributor
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Adam is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Adam is a new contributor. Be nice, and check out our Code of Conduct.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f962419%2fhow-to-get-multiple-path-in-wevtutil%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Adam is a new contributor. Be nice, and check out our Code of Conduct.
draft saved
draft discarded
Adam is a new contributor. Be nice, and check out our Code of Conduct.
Adam is a new contributor. Be nice, and check out our Code of Conduct.
Adam is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f962419%2fhow-to-get-multiple-path-in-wevtutil%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
