« Picture Post of the Week | Tunneling Dameware Mini Remote Control over WinSSHd »

Fun with Logparser.exe and EventID 1221

Here's a simple query against the Application log on a remote Exchange server through logparser.exe to grab 2 days worth of EventID 1221 (summary of online after-hours maintenance). I've added this to my daily Exchange server status script. Note per MS that you should do an offline defrag (eseutil /d) to get the real free space readings

LogParser.exe "select TimeGenerated, EventID, Message into out2.csv f
rom \\exchangeServer\Application where eventid = 1221 and TimeGenerated >= TO_LOCALTIM
E(SUB(SYSTEM_TIMESTAMP(),TIMESTAMP('2','d')))"

Posted by John Seaman on March 12, 2007 1:49 PM |

Post a comment

(If you haven't left a comment here before, you may need to be approved by the site owner before your comment will appear. Until then, it won't appear on the entry. Thanks for waiting.)