[SOLVED] Command to output Windows System Logs of a particular Event ID?

[DynV]

The best I found to output Windows System Logs of a particular Event ID, is through the GUI, which is slow like

and I'm hoping there's a command to do so, which I suspect would be considerably faster.

Thank you for your help or a tip

 

[Colif]

You might be able to search for the info in powershell but the output may not be what you want, I haven't tried any of these so I don't know what its results are - https://www.codetwo.com/admins-blog/how-to-check-event-logs-with-powershell-get-eventlog/ but that appears overly complicated.

Logging power events is easy with Event viewer..

here are the steps...

1. Open Event viewer and right click on Custom View and click on 'create custom view
2. Under the Filter Tab ; check "By Source" and from the Event sources dropdown select Kernel-Power, Power-Troubleshooter. Also check all the Event Levels.
3. Just above the Task Category you have space to enter the Event ID.. This is important as you dont need all the information except for entering sleep and resuming from sleep. Just enter 42,1
4. Leave the rest and click ok
5. Give a name for this Log ... and you are good to go.

Hope this is what you are looking for... let me know

https://answers.microsoft.com/en-us...t/e004a68c-f9a9-4982-86ba-a1cee05f9e4d?auth=1

seems to me you have to use Event viewer, to track sleep events.

 

[Alabalcho]

The reason it's slow is not because of GUI, but because it has to sift thru event log entries filtering out the information you're looking for. CLI utility (if any) won't speed up the search process.

 

[DynV]

https://answers.microsoft.com/en-us...t/e004a68c-f9a9-4982-86ba-a1cee05f9e4d?auth=1
seems to me you have to use Event viewer, to track sleep events.

That was even better than I thought. I was just using that to see what time I logged off (inconsistent query), but now I see the reason why it woke up, and I can try to stop those I don't want to (event I want to be attempted if the system is awake).

Thanks again