To define start or stop parameters for a log or alert
Using the Windows interface
Open Performance
Double-click Performance Logs and Alerts, and then click Counter Logs, Trace Logs, or Alerts.
In the details pane, double-click the name of the log or alert.
Click the Schedule tab.
Under Start log, click one of the following options:
To start the log or alert manually, click Manually. When this option is selected, to start the log or alert, right-click the log name in the details pane, and click Start.
To start the log or alert at a specific time and date, click At, and then specify the time and date.
Under Stop log, select one of the following options:
To stop the log or alert manually, click Manually. When this option is selected, to stop the log or alert, right-click the log or alert name in the details pane, and click Stop.
To stop the log or alert after a specified duration, click After, and then specify the number of intervals and the type of interval (days, hours, and so on).
To stop the log or alert at a specific time and date, click At, and then specify the time and date. (The year box accepts four characters; the others accept two characters.)
To stop a log when the log file becomes full, select options as follows:
For counter logs, click When the log file is full. The file will continue to accumulate data according to the file-size limit you set on the Log Files tab.
For trace logs, click When the n-MB log file is full. The file will continue to accumulate data according to the file-size limit you set on the Log Files tab.
When setting this option, take into consideration your available disk space and any disk quotas that are in place. An error might occur if your disk runs out of disk space due to logging.
Complete the properties as appropriate for logs or alerts:
For logs, under When a log file closes, select the appropriate option:
If you want to configure a continuous (automated) counter or trace logging, select Start a new log file.
If you want to run a program after the log file stops (for example, a copy command for transferring completed logs to an archive site), select Run this command. Also, type the path and file name of the program to run, or click Browse to locate the program.
By default, the program runs in the background. If you want to run an interactive program, you should also open Computer Management and select the Allow service to interact with desktop check box on the Log On tab in Performance Logs and Alerts. Use Run as to select an administrative account that has access to the system.
Where?
Programs > Administrative Tools > Computer Management > Services and Applications > Services > Performance Logs and Alerts > Log On tab
For alerts, under When an alert scan finishes, select Start a new scan if you want to configure continuous alert scanning.
Note
To open Performance, click Start, click Control Panel, click Performance and Maintenance, click Administrative Tools, and then double-click Performance.
When you schedule a log to close at a specific time and date or close the log manually, the Start a new log file option is unavailable.
If the log is set to start at a scheduled time using Start At, the log will restart if the system reboots during the scheduled time. The scheduled time is based on the Stop settings.
Using a command line
Open Command Prompt
Type:
logman update collection_name -m start stop
Value |
Description |
|---|---|
update collection_name |
Updates the collection query named collection_name. |
-m start stop |
Specifies that the logging will start and stop manually. Start specifies the time you want logging to start. Stop specifies the time you want logging to stop. |
Note
To open command prompt, click Start, point to All Programs, point to Accessories, and then click Command Prompt.
To view the complete syntax for this command, at a command prompt, type:
logman /?