Functions - EventLogCount

Returns an Integer giving the number of entries in the event logs that meet certain criteria. Different function signatures allow counts for all events of a certain type, or for combinations of source, category and event ID.

Syntax

EventLogCount(duration unit, duration value, type)
EventLogCount(duration unit, duration value, type, source)
EventLogCount(duration unit, duration value, type, source, category)
EventLogCount(duration unit, duration value, type, source, event ID)
EventLogCount(duration unit, duration value, type, source, category, event ID)

Parameters

duration unitThe unit for the duration.
duration valueThe value for the duration.
typeThe event type for which the entries will be counted.
sourceThe source for which the entries will be counted.
categoryThe category for which the entries will be counted.
event IDThe event ID for which the entries will be counted.

Notes

Possible values for the duration unit are "H", "D" and "W", for hours, days and weeks respectively.

Possible values for the event type are "I", "W", "E", "S" and "F", for informational, warning, error, success audit and failure audit type events respectively.

Examples

This expression part returns the number of error events in the logs for last two weeks.

EventLogCount("W", 2, "E")

This expression part returns the number of warning events in the logs for last 18 hours for the Service Control Manager.

EventLogCount("H", 18, "W", "Service Control Manager")

This expression part returns the number of informational events in the logs for last 10 days for the Windows Search Service in the Gatherer category.

EventLogCount("D", 10, "I", "Windows Search Service", "Gatherer")

This expression part returns the number of warning events in the logs for last three days for the Print system with an event ID of 4.

EventLogCount("D", 3, "W", "Print", 4)

This expression part returns the number of informational events in the logs for last five weeks for SQL Server with a category of Backup and an event ID of 18264.

EventLogCount("W", 5, "I", "MSSQLSERVER", "Backup", 18264)