Export (0) Print
Expand All

AdtAdmin.exe /SetQuery

 

An ACS collector can use Windows Management Instrumentation (WMI) Query Language (WQL) queries as filters to limit the events that are stored in the ACS database. The /SetQuery parameter implements the filter before events are saved to the ACS database. For more information on WQL and WQL queries, see Querying with WQL.

System_CAPS_noteNote

Because ACS supports only event queries, it does not support WQL aggregation operators.

AdtAdmin.exe /SetQuery [/Collector:CollectorName] /Query:QuerySyntax

Subparameter

Definition

/Collector:CollectorName

Specifies an ACS collector to query. If this subparameter is omitted, the local ACS collector is assumed.

/Query:QuerySyntax

Specifies the query syntax that defines the filter to apply.

This example uses the /SetQuery parameter to define a WQL query that filters out specified events. When applied, this query filters out events generated by System, Local Service, and Network Service services, and it also filters events that have specified event ID numbers.

adtadmin /setquery /collector:"Collector Name" /query:"SELECT * FROM AdtsEvent WHERE NOT ((HeaderUser='SYSTEM' OR HeaderUser='LOCAL SERVICE' OR HeaderUser='NETWORK SERVICE') OR (EventId=538 OR EventId=566 OR EventId=672 OR EventId=680 OR (EventId>=541 AND EventId<=547))"

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2015 Microsoft