[JM] 7/4/2009, I just re-write the sample code (which uses COM) included in the [LogParser] help, to my favourite programming language package require tcom console show set oLogQuery [::tcom::ref createobject "MSUtil.LogQuery"] set oEVTInputFormat [::tcom::ref createobject "MSUtil.LogQuery.EventLogInputFormat"] $oEVTInputFormat direction "BW" set oCSVOutputFormat [::tcom::ref createobject "MSUtil.LogQuery.CSVOutputFormat"] $oCSVOutputFormat tabs true set strQuery "SELECT TimeGenerated, EventID INTO C:\\output.csv FROM System" append strQuery " WHERE SourceName = 'Application Popup'" $oLogQuery ExecuteBatch $strQuery $oEVTInputFormat $oCSVOutputFormat ---- after running this example, go and see the contents of file c:\output.csv... for more information, see [LogParser] ---- !!!!!! %| [Category Parsing] | [Category File] |% !!!!!!