Read specific event id

[Iraj]

Greetings!

 

I was exploring as I saw the below URL which reads the event logs from specific type (Application, Security, System, etc.)

So, I was in need to read a specific event id instead of the type of event, i.e. I need to read event id 1074 which lands under Security type.

Any assistance will be grateful.

 

Happy new year in advance!!

[rudi]

Hello and welcome to the forum.

what URL are you referencing to?

 

Regards, Rudi.

[Iraj]

Sorry I forgot to add link

 

https://www.autoitscript.com/autoit3/docs/libfunctions/_EventLog__Read.htm

23 hours ago, rudi said:

Hello and welcome to the forum.

what URL are you referencing to?

 

Regards, Rudi.

 

[argumentum]

...you'll have to read every event until you read the one you wanted to read, so discard those you don't care for.
You can also add to TaskScheduler an event ( in your case, 1074 ) and run something when triggered.

Cheers

[Iraj]

On 1/3/2023 at 6:16 PM, argumentum said:

...you'll have to read every event until you read the one you wanted to read, so discard those you don't care for.
You can also add to TaskScheduler an event ( in your case, 1074 ) and run something when triggered.

Cheers

Any other way will be grateful enough...

[rudi]

you can use powershell to export event log entries, or this tool by NirSoft called FullEventLogView

 

all the EVTX files are stored usually in the folder C:\Windows\System32\winevt\Logs (RunAsAdmin will be required)

 

WMI is another way to get hold of event log entries, my favorite would be using powershell (filtering at the beginning is easy), then process the results with autoit