Applies To: Windows 8, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012.
Enables you to retrieve information about event logs and publishers. You can also use this command to install and uninstall event manifests, to run queries, and to export, archive, and clear logs.
Exemplo (de wevtutil qe /?
)
wevtutil qe Application /c:3 /rd:true /f:text
ou (mais complexo):
wevtutil qe /rd Application /q:"*[System[Provider[@Name='Microsoft-Windows-Perflib'] and (EventID=1023)]]" /uni:false /f:text
Com a opção /r
, o comando é executado em um computador remoto.