Windows Event Viewer Eventvwr /v: /l: /c: /f: /? - Specifies the computer name of the machine to view events for. If this ...

Windows Event Viewer

Eventvwr [] [/v:] [/l:] [/c:] [/f:] [/?]

 -- Specifies the computer name of the machine to view events for. If this is not given, local machine is assumed.

/v: -- Specifies a query or a view file created by event viewer. Query file must contain a valid Crimson XML query, starts with ; View file contains the XML query string along with other settings, but doesn't contain events. This option is mutually exclusive with /c and /l.

/l: -- Specifies the log file to be opened. This log file should be an exported evtx, evt or etl file. This option is mutually exclusive with /v and /c.

/c: -- Specifies the name of the channel to be selected when the viewer starts. This option is mutually exclusive with /v and /l.

/f: -- If used in conjunction with /c or /l, this specifies the filter to be applied to the channel or log, in the form of an XPath query; if not in conjunction with /c or /l, this must be a valid Event Log XML query that starts with . If the query contains a space, then the entire query must be enclosed in double quotes. If the query itself contains double quotes, then you must change the double quotes in the query to single quotes. For example, the XML query  must be specified as /f:" \"

/? -- Shows this usage message.