Query event view

[ehj]

How can I query from event viewer.

I can find 2 tables but no connection with computer

tsysEventAlerts
tsysEventfilter

[Hemoco]

You an use filter
>=getdate()-1

[googoo]

I think I figured it out:

Select Top 1000000 tblcomputers.Computer, tblntlogevent.Eventcode, tblntlogevent.Logfile, tblntlogevent.Message, tblntlogevent.Sourcename, tblcomputers.Description, tblntlogevent.TimeGenerated From tblntlogevent Inner Join tblcomputers On tblcomputers.Computername = tblntlogevent.Computername Where tblntlogevent.Eventcode = 7 And tblntlogevent.Sourcename = 'disk' And DateDiff(d, tblntlogevent.TimeGenerated, Current_TimeStamp) <= 2

[googoo]

Does anyone know how to change this query to only report entries from the current day?

[ehj]

Works great

Now I have a report that shows all machines with an error on hard drives.


Select Top 1000000 tblcomputers.Computer, tblntlogevent.Eventcode, tblntlogevent.Logfile, tblntlogevent.Message, tblntlogevent.Sourcename, tblcomputers.Description From tblntlogevent Inner Join tblcomputers On tblcomputers.Computername = tblntlogevent.Computername Where tblntlogevent.Eventcode = 7 And tblntlogevent.Sourcename = 'disk'

[Hemoco]

You need table "tblntlogevent"