中国DOS联盟

I want to achieve the following operations but don't know how to start. I can't find relevant materials.

Note that it's implemented with a script, not by manual export methods.

1: Save all local log events to a text file or an Excel file.

2: Query the local log events, respectively by (Type Date Time Source Category Event User Computer) to find. For example, find the detailed message of the event with ID 1000.

My usual practice is to run logfiles and then look at them one by one, heh

cscript %windir%\system32\eventquery.vbs /?

cscript %windir%\system32\eventquery.vbs /l system

Well, under the %windir%\system32 directory, the system comes with a vbs script Eventquery.vbs. Using this script, the requirements you mentioned can be met. The system requires it to be run under cscript.exe. You can use a format like cscript %windir%\system32\eventquery.vbs + parameters to use it.
For example:

cscript %windir%\system32\eventquery.vbs /?

cscript %windir%\system32\eventquery.vbs /l system

　　Great! I've learned a lot.

　　It seems there are many things in the system worth our discovery and utilization.

Actually, you can back up the eventlog with a WSH script. I used the dumpel.exe tool from the Windows Server Resource Kit in combination because the log records exported by the WSH script are.evt files, not plain text files, and they can only be opened with Event Viewer. Opening them with a text editor will result in garbled text. To make it easy to view, I used the dumpel.exe tool to export the log to a txt file. The WSH script you mentioned is available on Microsoft's website! Thanks