Loading…
21
Can we talk about switching from The Event Viewer to Log Parser for good?
For the last 8 years I have been a total Event Viewer loyalist. I mean I defended that thing like it was a family member, clicking through every error and warning one by one. Then last month I had to dig through 40,000 security logs for a breach investigation at a small law firm in Akron and I almost lost my mind. I got so frustrated I finally learned some basic Log Parser syntax after watching a 15 minute tutorial on a whim. The difference is night and day, I pulled the same data in about 90 seconds that took me almost three hours of clicking before. I still keep Event Viewer open for single events on one machine, but for anything across multiple systems I will never go back. Is there a better command line tool for this that you all use, or am I late to the party on something else?
1 comments
Log in to join the discussion
Log In1 Comment
evahenderson2d ago
Have you tried PowerShell's Get-WinEvent yet?
5