Por Thiago Alvarenga
GERENCIAR EVENTOS NO WINDOWS VIA COMANDOS
Contexto:
Um Administrador de Redes, em um ambiente com AD do Windows, necessita acessar a o Visualizador de eventos via comando. Para este fim, ele irá utilizar o PsExec do conjunto de ferramentas PSTools para alcançar a máquina, deste fim, com o tela do usuário de destino aberta será feito os seguintes procedimentos, logo abaixo.
Observação: Não faz parte do escopo deste artigo ensinar a usar o conjunto de ferramentas PSTools e também não será feito um passo a passo para baixar e executar. Saiba que esta ferramenta não necessita de instalação, basta pesquisar na internet, baixar colocar em uma pasta do windows e acrescentá-la na variável de ambiente (este último é opcional).
----------------------------------------------------------------------------------------------------------------------
Sintaxe:
WEVTUTIL
Recuperar informações sobre registros de eventos e editores. Arquivar logs em um formato independente, Enumerar os logs disponíveis, Instalar e desinstalar manifestos de eventos, executar consultas, Exportar eventos (de um log de eventos, de um arquivo de log ou usar uma consulta estruturada) para um arquivo especificado, Limpar logs de eventos .
WEVTUTIL {al | archive-log} Logpath [/l:Locale] # Archive an exported log.
WEVTUTIL {cl | clear-log} Logname [/bu:Backup] # Clear a log and optionally backup.
WEVTUTIL {el | enum-logs}] # List Log_Names and configuration, including max. size, enabled Y/N, and
pathname where the log is stored.
WEVTUTIL {epl | export-log} LogFile Exportfile # Export Event log, optionally a logfile path + structured query.
[/lf | Logfile :[true|false]] [/{q | query}:VALUE] # provide a Log name or log_file_path (if /lf = true)
[/{sq | structuredquery}:[true|false]] [/ow | Overwrite :[true|false] ]
WEVTUTIL {ep | enum-publishers} # List event publishers.
WEVTUTIL {gl | get-log} Logname # Display the log configuration and optionally output
[/{f | format}:[XML|Text]] # the config details in XML, plain text is the default.
WEVTUTIL {gli | get-loginfo} LogName [/lf | Logfile:[true|false]] # Get log status
# provide a Log name or log_file_path (if /lf = true)
WEVTUTIL {gp | get-publisher} PublisherName # Get publisher configuration, and optionally Event Metadata.
[/{ge | getevents}:[true|false]] [/gm:Message] # Obtain the publisher names with Wevtutil ep
[/{f | format}:[ XML | Text ]] # gm=get message, f=log file format.
WEVTUTIL {qe | query-events} Path [/lf | Logfile:[true|false]] # Query events from a log or log file.
[/sq:Structquery] [/q:XPathQuery] [/bm:Bookmark] # provide a Log name or log_file_path (if /lf = true)
[/sbm:SaveBookmark] [/rd | reversedirection}:[true|false]] [{f | format}:[ XML | Text | RenderedXml ]]
[/{l | locale}:VALUE] # Reverse returns most recent events first.
[{c | count}:N] [/{e | element}:VALUE] # Maximum number of events to read. / XML Root Element.
WEVTUTIL [{sl | set-log} LogName [/{e | enabled}:[true|false]] # Modify the configuration of a log.
[/{q | quiet}:[true|false]] [/{fm | filemax}:N] # Quiet / Max. enablements.
[/{i | isolation}:[system|application|custom]] # Log isolation mode.
[/{lfn | logfilename}:VALUE] [/{rt | retention}:[true|false]] # Log file / Log retention.
[/{ab | autobackup}:[true|false]] [/{ms | maxsize}:Size] # Log autobackup policy /Max log size.
[/{l | level}:Level] [/{k | keywords}:VALUE] # Level filter of log / Keywords filter.
[/{ca | channelaccess}:VALUE] [/{c | config}:VALUE] # Access permission (SDDL)/Path to the config file
# If /config is specified, do not also specify the LOG_NAME.
WEVTUTIL {im | install-manifest } MANIFEST # Install event publishers and logs from MANIFEST.
[ /{rf | resourceFilePath}:VALUE ] [/{mf | messageFilePath}:VALUE] # Resource/MessageFileName of the Provider
[ /{pf | parameterFilePath}:VALUE] # ParameterFileName of the Provider Element to be replaced.
WEVTUTIL {um | uninstall-manifest} MANIFEST] # Uninstall event publishers and logs from MANIFEST.
Common options:
/{r | remote}:VALUE
If specified, run the command on a remote computer. VALUE is the remote computer
name. Options /im and /um do not support remote operations.
/{u | username}:VALUE
Specify a different user to log on to the remote computer. VALUE is a user name
in the form domain\user or user. Only applicable when option /r is specified.
/{p | password}:VALUE
Password for the specified user. If not specified, or if VALUE is "*", the user
will be prompted to enter a password. Only applicable when the /u option is specified.
/{a | authentication}:[Default|Negotiate|Kerberos|NTLM]
Authentication type for connecting to remote computer. The default is Negotiate.
/{uni | unicode}:[true|false]
Display output in Unicode. If true, then output is in Unicode.
The primary focus of WEVTUTIL is the configuration and setup of event logs.
Some applications can completely fill their respective event log with errors (Office 2016 I'm looking at you) being able to enumerate the log size and location is a useful tool for tracking down such problems.
Most options for WEVTUTIL are not case sensitive, but the built-in help is and must be requested in UPPER case.
To retrieve event log data the PowerShell cmdlet Get-WinEvent is easier to use and more flexible.
WEVTUTIL was first made available in Windows Vista.
Examples
Clear all the events from the Application log:
C:\> WEVTUtil.exe clear-log Application
Batch file to parse every Event log installed on the computer and clear them all:
@echo off
for /f "tokens=*" %%G in ('wevtutil.exe el') do (wevtutil.exe cl "%%G")
Export events from the System log to C:\backup\ss64.evtx
C:\> WEVTUtil export-log System C:\backup\ss64.evtx
List the event publishers on the current computer.
C:\> WEVTUtil enum-publishers
Uninstall publishers and logs from the SS64.man manifest file:
C:\> WEVTUtil uninstall-manifest SS64.man
Display the 50 most recent events from the Application log in text format:
wevtutil qe Application /c:50 /rd:true /f:text
Find the last 20 startup events in the System log:
C:\> WEVTUtil query-events System /count:20 /rd:true /format:text /q:"Event[System[(EventID=12)]]"
----------------------------------------------------------------------------------------------------------------------
Comando usado para acessar a máquina remotamente:
C:\PSTools\PsExec.exe \\10.10.10.11 -u meudominio.local\meusuario -p minhasenha cmd
Exemplo de como apagar as entradas do visualizador de eventos: "Aplicativos".
Comando:
wevtutil gl Application
Listando e salvando a saída do comando:
wevtutil el | more > c:\temp\eventos.txt
Bibliografia:
https://ss64.com/nt/wevtutil.html Acesso às 15:32 do dia 04/06/2019
https://edmarinho.wordpress.com/2012/06/05/resumo-comando-para-gerenciar-evento-do-windows/ Acesso às 15:08 do dia 04/06/2019
https://winaero.com/blog/how-to-clear-the-windows-event-log-from-the-command-line/ Acesso às 15:01 do dia 04/06/2019
