Windows Server 2008 : Working with Event Subscriptions - Managing Subscriptions with wecutil & Logging Events with eventcreate

8/9/2011 3:27:29 PM

Managing Subscriptions with wecutil

The basic command you use with wecutil is qc (as wecutil qc) to configure the collector computer. However, there are more commands.

wecutil Command	Comments
Enumerate subscriptions. C:\>wecutil es	Lists existent subscriptions.
Get runtime status of subscription. wecutil gr subscription-name C:\>wecutil gr "ad replication"	Gets subscription runtime status.
Export a subscription to an XML file. wecutil gs "subscription-name" /f:xml > filename C:\>wecutil gs "ad replication" /f:xml > adrep.xml	The gs command gets subscription configuration. The /f:xml switch formats the output as XML. You can redirect this to an XML file with the > symbol to a file.
Create subscription from XML file. wecutil cs xml-file C:\>wecutil cs adrep.xml	Creates a new subscription. If you have an XML file, you can create (or re-create) the subscription using the cs command.
Delete the subscription. wecutil ds "subscription-name" C:\>wecutil ds "ad replication"	The ds command deletes the subscription.
Set event delivery optimization. wecutil ss "subscription-name" /cm:normal \| minlatency \| minbandwidth \| custom C:\>wecutil ss "ad replication" /cm:normal C:\>wecutil ss "ad replication" /cm:minlatency C:\>wecutil ss "ad replication" /cm:minbandwith	You can modify a subscription with the ss (set subscription) command. The /cm switch enables you to change the Event Delivery Optimization settings (shown as the Advanced Subscription Settings in Figure 26-7 after clicking the Advanced button). You can use the /cm:custom switch to configure more advanced settings, such as changing the latency. This requires an additional switch as shown in the next example.
Set latency to 15 seconds. wecutil ss "subscription-name" /cm:custom /dmlt:number-of- milliseconds C:\>wecutil ss "ad replication" /cm:custom /dmlt:15000	You can use the /dmlt switch to specify the time between updates (delivery maximum latency time). It is set in milliseconds. You can change this only when you change the configuration mode to custom with /cm:custom. The example changes the latency to 15,000 so that updates are sent every 15 seconds. Figure 1 shows the result of this command. Notice that it is set to custom, and custom is dimmed. You can change this back by changing the configuration mode using /cm:normal, /cm:minlatency, or /cm:bandwidth.

Figure 1. Changing the latency to a custom configuration

Tip

There are many more settings you can configure with wecutil commands. If you want to dig deeper, check out the TechNet website: http://technet.microsoft.com/library/cc753183.aspx.

Logging Events with eventcreate

In the context of event logs, there might be times when you want to log specific information into either the Windows Server 2008 Application or System logs. You can do this from the command line or from a batch file using the eventcreate command. The syntax is

eventcreate  [/l application | system ] /t error | warning |
information  /id eventid /d description

For example, if you want to log an error in the Application log to indicate an application failure, you can use either of the following commands. Because it defaults to the Application log, you don’t have to include the /l switch.

eventcreate /l application /t error /id 999
/d "Application Failure"
eventcreate /t error /id 998 /d "Application Failure"

Figure 2 shows the event logged in the Application log from these commands.

Figure 2. An event created from the eventcreate command

The following table identifies the different elements within an eventcreate command.

eventcreate Switches	Comments
Target log. /l application \| system /l system	The /l (the lowercase letter l, not the number 1) switch specifies the log where you want the event recorded. You can specify either the application or system log. If you don’t specify a log, it defaults to the application log.
Identify type of log entry. /t error \| warning \| information /t error	The /t switch is used to specify the type of entry. You must specify error, warning, or information as the type.
ID number. /id number /id 999	The /id identifies the number for the event. You can use any number between 1 and 1,000.
Description of event. /d "description" /d "Application failed"	Add a free text description with the /d switch. The description is logged with the event and must be enclosed in quotes if it has spaces.
Remote system. /s remotecomputername \| IP-address /s dc2 /s 192.168.1.6	The event is logged on the local computer by default. However, you can use the /s switch to have the event logged on a remote computer. You must include the /u and /p switches with this switch.
Username. /u domain\user /u pearson\administrator	Runs the command with the specified user account. The account is specified as the user name for a local account, or the domain and user name (domain\username) for a domain account.
Password. /p password /p P@ssw0rd	Specifies the password of the user account. If you put the password in a batch file, it can be read by anyone that has access to the batch file.

Tip

A new feature available with Windows 2008 is the capability to attach tasks to events. These tasks can run files or scripts, display a dialog box, or send an email. In other words, if you created an event with event ID of 999, you can then attach a task to that event.