Copyright © 1997-2007 Frank Heyne - All rights reserved - Last update: 05. February 2007
If you want to put this page on your own web server, please renounce and use a link instead. The reason is simple: I don't want old copies with old versions of the FAQ laying around on the web.
If you call EventSave with the /a option, it will copy all logs of all machines into the same directory. Otherwise you have the
possibility to select a different destination directory for every machine. I do suggest to use only one directory for all machines,
otherwise you can't make full use of Elwiz.
But if you prefer to move the events from SERVER1 and SERVER2 into existing local directories on each machine, you could use a batch
file like the following:
"c:\Program Files\Heysoft\eventsave.exe" \\SERVER1\c$\events /CSERVER1
"c:\Program Files\Heysoft\eventsave.exe" \\SERVER2\c$\events /CSERVER2
In case you want to evaluate your logs daily and archive them as well, you create the following batch file and schedule it to run every day at 0:00. We assume all programs are located in the directory d:\Events
rem make sure a subdirectory Daily for daily reports exists!
if not exist d:\events\daily\nul md d:\events\daily
rem make sure a subdirectory monthly for archived logs exists!
if not exist d:\events\monthly\nul md d:\events\monthly
rem first delete old logs:
del d:\Events\Daily\*.evt
rem now copy new events:
d:\Events\EventCopy d:\Events\Daily
rem now archive new events into a different directory:
d:\Events\EventSave d:\Events\monthly
rem now do your evaluation, for instance:
d:\Events\r528 d:\Events\Daily /m /z+
d:\Events\r529 d:\Events\Daily /m /z+
No, there is no such option.
But I think there are command line tools available for compressing files. So you could create a batch file that first runs EventSave and afterwards another tool that compresses the resulting files. The last line of your batch file would delete all *.evt files in this directory.
The reason EventSave does not compress is because no event viewer and evaluation tool would be able to read the files anymore.
No. You need to consider that the other tools from Heysoft which work with event files use the naming convention Year_Month_Computer_Eventlog.evt. If EventSave would change this, all other programs would have a problem interpreting the file names correctly.
But if you really need to, you could easily change the file names of the evt files of the last month with the following command:
for /f "delims=_ tokens=1,2,3,4" %A in ('dir 2006_04*.evt /b') do rename %A_%B_%C_%D %C_%A_%B_%D
In case you want to run this command within a batch file, you need to double the % characters.
After collecting the events, EventSave deletes them on the source machines.
With Windows 6 the eventlog format changed. The events are gathered in evtx files now. It is still possible to backup the events to evt
files, but you loose information if you do so. This is, for example, the exact time when the event occurred (evt files save time with
an accuracy of 1 second, but evtx files save time with an accuracy of 1 millisecond) or the IDs of the process and even thread of the
program which created the event.
If you enforce EventSave with option /V6 to collect and clear events from machines running Windows version 6 or above (Vista and later), you will loose part of the information of the events, which can not be restored later!
I don't think this is a good idea. There are lots of unknown events. Probably anybody will fail to add some important seldom events to the list. (The warnings which reported errors on my HD days before it really crashed come to mind.)
With my philosophy you won't miss critical events, with yours you would. You can take a logfile, select an entry, press the right mouse button, choose "Add entry to Watcher filter rules... " and build your filter files very fast this way. And if you install new software (which creates new log entries), you will get them automatically (with the option to add them to the filter list) with my method.
Anyway, Elwiz allows to do what you want. There are "Show Always" and "Ignore Always" filter rules. You could,
for instance, take any Print event to create a filter rule that tells Elwiz to ignore all Print events. Next, you define another rule,
which says, that Print events 20 (Changing of printer drivers) should always alert.
As you see, it is not necessary to create Ignore rules for every event ID.
How should this option work? There are very many possibilities why a specific event is filtered, e.g.:
You require a special version of the Eventwatcher service for this purpose. When registering, notice how many admins should be able to watch the events at the same time. The price for n admins will be n times as much as the normal version, by the way.
You need to provide the domain name to which the machine running Elwiz belongs to. The machines you want to watch can be in every domain, there is no limit (except the number of licences you did buy ;)
It is possible to deactivate this perfmon object. Up to NT 4 it was enabled by default, but in NT 5 it is disabled. Unfortunately
this change is not documented.
The command for enabling the object is: diskperf -yv You need to reboot to make the changes work.
It is only a simple measure of copy protection. net config rdr on the machines where you want to run the software will tell you the valid name of the Workstation domain that you need to provide.
No. If you want to license the software for instance for 20 domains, you can get a campus license as well.
You only need to register Elwiz for the domain where you want to run the program. The watched machines may be members of any domain. Of course you need the appropriate rights to access the event logs on these machines.
You have 4 options:
The Report Event tools all do only work with saved eventlog files. This is because NT itself does not allow other programs to access the data of a log currently in use. The first step you have to do is running EventSave.exe (preferably with a separate destination directory). Then run the tools in this directory.
All current shareware versions install silently when run for the first time, without doing anything else. Be aware that you can test the shareware versions only with a single account! For instance, if you did install a tool under the admin account, you can't run it as well in the Scheduler service, if this service runs under a different account. You need to register when you want to run the tools under different accounts. Another good reason for registering is that you can't set all options in the shareware versions.
Nick Tonkin wrote a nice Perl script that does what you want. (BTW, there is a small error on his page - of course R528 will process logs from all versions of NT, not only 4.0 Server.)
You can use EventSave to save all your logs onto one machine. Than you can evaluate all logs with one license of the tools. The
tools will only run on machines of the domain(s) you named in the order form!
If you want to evaluate the events of every domain in this domain itself, you need a registered version for every domain.
If print event 10 does report the right number of printed pages for non-canceled print jobs, it will do so when a job is canceled, too. This is possible because the event is created when printing is finished, not when it starts. But as you can read in the documentation of RP10, there are many occasions (for instance when printing multiple copies of a document with Microsoft Word for Windows 7.0) where the wrong number of pages is reported by default.
Ooops, just have a look at the readme file:
"You have to run EventSave, EventSave+ or EventCopy before you can use any of the other "Report Event for Windows NT"
tools."
This is because R528 only tries to evaluate Security logs. Therefore it expects a file with the string "sec" in its name, as the freeware program EventSave assigns automagically. This naming convention does allow R528 to skip application and system evt files.
When you rename your file rep.evt into security.evt, R528 will work!
You can tell MER to copy only specific events, for instance:
MER /ttarget.evt source.evt /e560
This command will only copy events with ID 560 from source.evt to target.evt
When using EventSave(+) you can loose information, because the events will be cleared after they are backed up. All information not
converted from evtx format to evt format will be lost forever. (See answer B13, also.)
Because neither EventCopy nor ECA delete the original events after they are copied to the backup files, there is no risk to loose
information with both tools.