WDumpEvt is an administration tool that makes it easy to view and manage all the information from Windows NT and Windows 2000 eventlog.

Choose to gather information from the local machine or any workstation or server running Windows NT or Windows 2000 on the network through a simple browse command that lets you point to any available logs of a computer. Just launch the program on this computer and choose what you want to view or report on.

• View and print:
  • The list of events
  • The list of user sessions
  • The list of failure sessions
  • The list of RAS sessions,
  • The list of print jobs.
• Dump the data to a file in ASCII-delimited format or CSV format for importing into a database or spreadsheet, or choose HTML format for an easy-to-read display:
  • The list of events
  • The list of user sessions
  • The list of failure sessions
  • The list of RAS sessions,
  • The list of print jobs.
  The resulting file can contain information such as type, number, and category of the event, plus computer name, date, user, description.
• Dump either one, or all the events, or just from the last dump.
• Erase or/and save the data in the eventlog.
• Schedule all these actions thanks to the LogSched service to have regular save, erase or dump.
• Retrieve properties about eventlog files: events number, begin and end date, file size....

The package is composed of three modules:

You need only to unzip the file WDEvt22.zip in a directory to use these tools

You need recent version of some system dll (MFC42.DLL, msvcrt.dll and msvcp60.dll) with this version of WDumpEvt. If you get the message as The ordinal 6876 could not be located in the dynamic link library MFC42.DLL the dll on your system are too old and you must load a newer version. Click here

My the advice is to copy the new dll into the install directory of WDumpEvt and if you install the service, don't copy LogSched.exe into a system directory but run it directly from the WDumpEvt directory

For a remote installation of the service, don't forget to copy the dll too.

To uninstall the software, use the add/remove of the control panel. (Don't forget to uninstall the service before uninstall the WDumpEvt software)

Registration

You can use this software free of charge only for 30 days evaluation period before registering.
Three additional tools usable on command lines are distributed only to registered users:

	CDumpEvt	Dump of eventlog.
	CDumpSession	Dump of user sessions, failure sessions , RAS sessions and print jobs.
	CSavEraLog	Save and erase of the eventlog.

I need your help

With Windows 2000, I have noticed that some events change their ID and some new one appears. It will be interesting to add some of them in the sessions list. Unfortunately, I have no eventlog to test it on.

If you have an eventlog (Windows NT 4 or Windows 2000) with events that seems interesting to add to my software, please send it to me. I am specially interested by system eventlog with RemoteAccess logon/logoff other than event 20050

Thank for your help.