How to view Windows eventlog items with GVim

Question

Is it possible to read the Windows-eventlogItems using GVim? Our application logs errors in the eventlog, it would be nice if I could read them using GVim.

A daily export to file is not an option: it should be instant : error happens, switch to GVim, read details of the last X items.

Answer 1

You have to export the events everytime you want to look at them.

Route One: Use wevtutil and logparser to create some .txt

 % wevtutil epl XYZ %TEMP%\log.evtx

Then you install LogParser and use it like this:

 % logparser -i:evt -o:csv "SELECT * INTO %TEMP%\log.csv FROM %TEMP%\log.evtx"

After which you can

 % gvim %TEMP%\log.csv

Note: Replace 'XYZ' in the first line with whatever part of the event log you are interested at, these snippets should get you started.

Check out http://martin77s.wordpress.com/tag/logparser/ as well.

Route Two: Use psloglist from Sysinternals and use it like this:

 :%!psloglist -h 1 -o XYZ

where XYZ is the event source (maybe the name of your app). Looks simpler to me.

Answer 2

You can export the Event Log to an file. In Windows 7 right click on the event category and choose "Save All Events As". I believe that exists in previous versions of Windows as well. Then you can edit that file with Vim.