EventTriggers

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/eventtriggers.mspx?mfr=true

• /create - is used to create an event trigger,
• /delete can be used to delete the trigger
• /eid - is the event id number you wish to track
• /tr - is the name you would like to give to the event trigger
• /ru - is the user name to run under userdomain or user@domain.com are both acceptable
• /rp - is the user password
• /tk - is the action you would like performed when triggered

• /query - a list of event triggers

How to set event log security locally or by using Group Policy in Windows Server 2003

http://support.microsoft.com/kb/323076/en-us
http://social.technet.microsoft.com/Forums/zh-TW/winserverzhcht/thread/eda758fa-8841-4d64-9edb-5b798d99600d/

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Security
對CustomSD點兩下後,在最後面加上下面一行

(A;; 0x1;;;UserSID)

A=Allow

D=Deny

1 = 讀取
2 = 寫入
3 = 讀取+寫入
4 = 清除

7 = 讀取+寫入+清除

LogParser -- (2)

How do I retrieve the event logs that have been logged in the past 10 minutes?

You need to use the SUB function to subtract 10 minutes from the current UTC timestamp returned by the SYSTEM_TIMESTAMP function, and convert this timestamp to local time using the TO_LOCALTIME function:

SELECT *
FROM System
WHERE TimeGenerated >= TO_LOCALTIME( SUB( SYSTEM_TIMESTAMP(), TIMESTAMP( '10', 'mm' ) ) )

LogParser -- (1)

logparser "SELECT * FROM Application.evt"
Task aborted.
Cannot open <from-entity>: Error opening event log "\\?\C:\Application.evt": The event log file is corrupted.

Statistics:
-----------
Elements processed: 0
Elements output:    0
Execution time:     0.61 seconds

Solution:

wevtutil epl application.evt application.evtx /lf:true

wevtutil export-log application.evt application.evtx /lf

wevtutil [{el | enum-logs}] [{gl | get-log} <Logname> [/f:<Format>]]
[{sl | set-log} <Logname> [/e:<Enabled>] [/i:<Isolation>] [/lfn:<Logpath>] [/rt:<Retention>] [/ab:<Auto>] [/ms:<Size>] [/l:<Level>] [/k:<Keywords>] [/ca:<Channel>] [/c:<Config>]] 
[{ep | enum-publishers}] 
[{gp | get-publisher} <Publishername> [/ge:<Metadata>] [/gm:<Message>] [/f:<Format>]] [{im | install-manifest} <Manifest>] 
[{um | uninstall-manifest} <Manifest>] [{qe | query-events} <Path> [/lf:<Logfile>] [/sq:<Structquery>] [/q:<Query>] [/bm:<Bookmark>] [/sbm:<Savebm>] [/rd:<Direction>] [/f:<Format>] [/l:<Locale>] [/c:<Count>] [/e:<Element>]] 
[{gli | get-loginfo} <Logname> [/lf:<Logfile>]] 
[{epl | export-log} <Path> <Exportfile> [/lf:<Logfile>] [/sq:<Structquery>] [/q:<Query>] [/ow:<Overwrite>]] 
[{al | archive-log} <Logpath> [/l:<Locale>]] 
[{cl | clear-log} <Logname> [/bu:<Backup>]] [/r:<Remote>] [/u:<Username>] [/p:<Password>] [/a:<Auth>] [/uni:<Unicode>]

Event Collector is managed with a command-line tool, Windows Event Collector Utility (Wecutil.exe).

How to move user Databases

The procedures in this topic require the Logic name of the database files. To obtain the name, query the name column in the "sys.master_files" catalog view.
>select * from sys.master_files

To move a data or log file as part of a planned relocation, follow these steps:

1. Run the following statement.
>ALTER DATABASE database_name SET OFFLINE;

2. Move the file or files to the new location.

3. For each file moved, run the following statement.
>ALTER DATABASE database_name MODIFY FILE ( NAME = logical_name, FILENAME = 'new_path\os_file_name' );

4. Run the following statement.
>ALTER DATABASE database_name SET ONLINE;

5. Verify the file change by running the following query.
>SELECT name, physical_name AS CurrentLocation, state_desc FROM sys.master_files
WHERE database_id = DB_ID(N'<database_name>');

mbralign options of NetApp

mbralign --sparse /vmfs/volume/"Datastore"/"Virtual Machine"/"Virtual Machine"-flat.vmdk

Options:

   --sparse                 The resulting file will be sparse.  This option is designed for NetApp NFS based datastor                            es.

   --force                  The default behavior is to skip properly aligned disks.

                            The --force option can be used to override this. (Useful for migrating and making sparse)                            .

   --bs=n                   Use n as the block size (specified in kB).  n must be one of (8, 16, 32, 64, 128, 1024).                             The default is 8.

   --preview                Show what would be done, then exit.  No changes are madeto the file.

   --quiet                  Only print warnings and errors (no other status isprinted to screen).

   --debug                  Print debug comments.

   --help                   Print usage.

   --thereAreNoVmSnapshots  Suppress the warning message about snapshots and answer YES to the question of whether to                            continue.

Cloning and converting virtual machine disks with vmkfstools

vmkfstools -i <input> <output> -d <format>

Convert HD type to thin-provision
1. SSH to VM host.
2. Shutdown the virtual machine.
3. vmkfstools -i "guest.vmdk" "new_guest.vmdk" -d thin
4. Add new HD and point to the "new_guest.vmdk" under "Edit setting"
5. Power-on the virtual machine.
6. Delete the "guest.vmdk" file.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1028042