Windows 2008 Event Viewer

(imported topic written by FITZPAW91)

Hi All

I am trying to get output out of Setup log of Windows 2008 Event Viewer. I have no problems getting the older event viewer logs, Application, Security and System, but I get the following error when I run…

Q: descriptions of records whose (event id of it = “2” AND source of it = “Servicing”) of setup event log

E: The operator “setup event log” is not defined.

Any help would be appreciated

William

(imported comment written by NoahSalzman)

Try using

event log “setup”

instead of

setup event log

I don’t think we have a named inspector for the “setup” event log so you have to use that “generic” naming method.

(imported comment written by FITZPAW91)

Hi Noah,

That didn’t seem to work. I made the relevance a bit less complicated and these are the results

description of record whose (source of it = “WUSA”) of event log “Setup”

q: description of record whose (source of it = “WUSA”) of event log “Setup”

E: Singular expression refers to nonexistent object.

Thanks

William

(imported comment written by NoahSalzman)

Yeah, I think my suggestion was incorrect. Let’s see if any one else chimes in.

(It turns out, on my machine, that

number of records of event log “setup”

happens to return the same number of records as

number of records of event log “foo”

. So, that inspector clearly doesn’t work the way I thought it should… or there is a bug.)

(imported comment written by BenKus)

See here:

http://forum.bigfix.com/viewtopic.php?id=2519

Ben