Return
-
Title
How to use ITEventExtractor.exe to extract logs according to time frame -
Description
When DateFrom or DateTo switches are used with the ITEventExtractor.exe tool, the extraction extracts all data for the specified log and server regardless of time.
-
Cause
When the DateFrom and DateTo switches are used, both must be specified to extract correctly.
-
Resolution
Use both the DateFrom and DateTo switches to extract a specific time frame of events from a repository:
C:\Program Files (X86)\Common Files\Quest\InTrust>ITEventExtractor.exe /reppath:"C:\Program Files\Quest Software\InTrust\Server\InTrust\Repository" /logname:Security /computer:computername /domain:domainname /file:c:\sectest.evt /SRVPORT:ncacn_ip_tcp:localhost[8340] /datefrom:mm/dd/yyyy /dateto:mm/dd/yyyy