CODEWITHSUNDEEP
wmic
digger
digger

Reputation: 55

how to get the information of system log of taskscheduler under the command line with WMIC?

I need to know whether the taskscheduler has run successfully. I found difficult to get a return value by the wmic command, because they aren't included in the system, security, application hardwareevents and so on logfile. Following is my attempts:

wmic ntevent "eventcode=140" get message /value

The above code returns the message: "no instance(s) availalbe."

As I don't know which kind of logfile includes the log records of taskschedule, I select them by the eventcode.

wmic ntevent where "logfile='system' and eventcode='140'" get message /vule

No matter, logfile='appliaction' or logfile='security', at the end I can't get the result I want.

What i need to point out is the log records are allocated in Microsoft-Windows-TaskScheduler/Operational in graphical interfaces.

Upvotes: 3

Views: 8443

Answers (1)

JosefZ
JosefZ

Reputation: 30123

Unfortunately, wmic can only be used on classic logs. List them by
wmic NTEventlog get LogfileName or by powershell Get-EventLog -AsString -List:

Application
HardwareEvents
Internet Explorer
Key Management Service
PreEmptive
Security
System
TuneUp
Windows PowerShell

Switch to wevtutil: wevtutil enum-logs enumerates the available logs and 

wevtutil qe Microsoft-Windows-TaskScheduler/Operational /q:"*[System[Provider[@Name='Microsoft-Windows-TaskScheduler'] and (EventID=140)]]" /uni:false /f:text

command could be a starting point for you. Pretty weird syntax and result hard do parse. Moreover:

The primary focus of WEVTUTIL is the configuration and setup of event logs, to retrieve event log data the PowerShell cmdlet Get-WinEvent is easier to use and more flexible:

Switch to powershell: (Get-WinEvent -ListLog *).LogName enumerates the available logs and one can simply filter and format result from next command:

Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational

For instance, to format the result in list view to see all properties:

Get-WinEvent -LogName Microsoft-Windows-TaskScheduler/Operational | Format-List *

Read more in Powershell and the Applications and Services Logs.

Upvotes: 4

Related Questions