WEVTUTIL queries
It is possible to query the event log in Windows Vista using the WEVUTIL command line tool, passing any arbitrarily complex query. Unfortunately, the syntax needed by the query command line paramter (/q) doesn't seem to be documented (I was searching for this syntax when I got my
own article back) Thanks to
Ted Barnes for the question.
I've found that the simpliest way to get the search query is to let Vista do the heavy lifting for you. First, create a filter, as shown below
Then, save the filter to a custom view
Bring up the properties of this custom view
And edit the filter
Apply whatever filter you need
And then copy the text of the Select element to as the /q paramter
In this case, the syntax would be:
wevtutil qe System /rd:true /f:text /q:*[System[(EventID=7036)]]