Catch Windows system log events to a text file
Quick answer; manually, from Event Viewer, click on the System Log, then go to View > Filter and choose W32Time
from the Event Source dropdown. Press OK. Then go to Action > Export List and enter your filename. If you want detail as well, you would have to save the entire log file, with Action > Save Log File As, and choose Tab Delimeted
or Comma Separated
from the Save as Type dropdown.
Long answer is, scripting. Use WMI to query the Win32_NTLogEvent
and spool it to a file with either the FileSystemObject or output redirection:
On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent WHERE SourceName = 'W32Time'",,48)
Dim fso : Set fso = CreateObject("scripting.filesystemobject")
Dim ts : Set ts = fso.CreateTextFile("X:\w32time_events.txt", True)
For Each objItem in colItems
ts.WriteLine "Category: " & objItem.Category
ts.WriteLine "CategoryString: " & objItem.CategoryString
ts.WriteLine "ComputerName: " & objItem.ComputerName
ts.WriteLine "Data: " & objItem.Data
ts.WriteLine "EventCode: " & objItem.EventCode
ts.WriteLine "EventIdentifier: " & objItem.EventIdentifier
ts.WriteLine "EventType: " & objItem.EventType
ts.WriteLine "InsertionStrings: " & objItem.InsertionStrings
ts.WriteLine "Logfile: " & objItem.Logfile
ts.WriteLine "Message: " & objItem.Message
ts.WriteLine "RecordNumber: " & objItem.RecordNumber
ts.WriteLine "SourceName: " & objItem.SourceName
ts.WriteLine "TimeGenerated: " & objItem.TimeGenerated
ts.WriteLine "TimeWritten: " & objItem.TimeWritten
ts.WriteLine "Type: " & objItem.Type
ts.WriteLine "User: " & objItem.User
ts.WriteBlankLines 1
Next
ts.Close
Set ts = Nothing
Set fso = Nothing
Set colItems = Nothing
Set objWMIService = Nothing
Cheating option, if you can't be bothered; from a cmd
command prompt, try:
wmic NTEVENT | find /i "W32Time" > W32Time_Events.txt
HTH
J.