C:\WINDOWS>EVENTCREATE /?

EVENTCREATE [/S system [/U username [/P [password]]]] /ID eventid
           [/L logname] [/SO srcname] /T type /D description

Description:
   This command line tool enables an administrator to create
   a custom event ID and message in a specified event log.

Parameter List:
   /S    system           Specifies the remote system to connect to.

   /U    [domain\]user    Specifies the user context under which
                          the command should execute.

   /P    [password]       Specifies the password for the given
                          user context. Prompts for input if omitted.

   /L    logname          Specifies the event log to create
                          an event in.

   /T    type             Specifies the type of event to create.
                          Valid types: ERROR, WARNING, INFORMATION.

   /SO   source           Specifies the source to use for the
                          event. A valid source can be any string
                          and should represent the application or
                          component that is generating the event.

   /ID   id               Specifies the event ID for the event. A
                          valid custom message ID is in the range
                          of 1 - 1000.

   /D    description      Specifies the description to be set for
                          the newly creating event.

   /?                     Displays this help/usage.


Examples:
   EVENTCREATE /T ERROR /ID 100
       /L APPLICATION /D "Create an event in application log"

   EVENTCREATE /T ERROR /ID 999 /L APPLICATION
       /SO WinWord /D "new source Winword in application log"

   EVENTCREATE /S system /T ERROR /ID 100
       /L APPLICATION /D "Remote system without user credentials"

   EVENTCREATE /S system /U user /P password /ID 100 /T ERROR
       /L APPLICATION /D "Remote machine with user credentials"

   EVENTCREATE /S system /U domain\user /ID 100 /T WARNING
       /SO MyBatchFile.cmd /D "Maintenance script user logon failed"



C:\WINDOWS>EVENTTRIGGERS /?

EVENTTRIGGERS /parameter [arguments]

Description:
   This command-line tool enables an administrator to display and
   configure "Event Triggers" on local or remote system.

Parameter List:
   /Create     Create a new Event Trigger that will monitor and act
               upon the occurrence of NT Log Events of given criteria.

   /Delete     Deletes an Event Trigger by its trigger ID.

   /Query      Displays the Event Trigger properties and settings.

   /?          Displays this help/usage.

Examples:
   EVENTTRIGGERS /Create /?
   EVENTTRIGGERS /Delete /?
   EVENTTRIGGERS /Query  /?



C:\WINDOWS>EVENTTRIGGERS /CREATE /?

EVENTTRIGGERS /Create [/S system [/U username [/P [password]]]]
                     /TR triggername /TK taskname [/D description]
                     [/L log]                       [/RU username [/RP
password]]

Description:
   Create a new Event Trigger that will monitor and act upon the
   occurrence of NT Log Events of a given criteria.

   NOTE: Using /EID, /T and /SO together act as a series of AND's.

Parameter List:
   /S      system           Specifies the remote system to connect to.

   /U      [domain\]user    Specifies the user context under which the
                            command should execute.

   /P      [password]       Specifies the password for the given user
                            context. Prompts for input if omitted.

   /TR     triggername      Specifies a friendly name to associate with
                            the Event Trigger.

   /L      log              Specifies the NT Event Log(s) to monitor
                            events from. Valid types include:
                            Application, System, Security, DNS Server
                            Log and Directory Log. The wildcard "*"
                            may be used and the default value is "*".

   /EID    id               Specifies a specific Event ID the Event
                            Trigger should monitor for.

   /T      type             Specifies an Event Type that the trigger
                            should monitor for. Valid values include:
                            "ERROR", "INFORMATION", "WARNING",
                            "SUCCESSAUDIT" and "FAILUREAUDIT".

   /SO     source           Specifies a specific Event Source the Event
                            Trigger should monitor for.

   /D      description      Specifies the description of the Event
                            Trigger.

   /TK     taskname         Specifies the task to execute when the
                            Event Trigger conditions are met.

   /RU     username         Specifies the user account (user context)
                            under which the task runs. For the system
                            account value must be "".

   /RP     password         Specifies the password for the user.
                            To prompt for the password, the value
                            must be either "*" or none.
                            Password will not effect for the "SYSTEM"
                            account.

   /?                       Displays this help/usage.

Examples:
   EVENTTRIGGERS /Create /?
   EVENTTRIGGERS /Create /TR "Disk Cleanup" /L SYSTEM /T ERROR
                         /TK c:\windows\system32\cleanmgr.exe
   EVENTTRIGGERS /Create /S system /U user /TR "Low Disk Space"
                         /EID 4133 /T WARNING
                         /TK \\srv\share\dsk.cmd
   EVENTTRIGGERS /Create /S system /U domain\user /P password
                         /TR "Disk Backup" /EID 4133 /L SYSTEM
                         /T ERROR /TK \\system\share\ntbackup.exe
   EVENTTRIGGERS /Create /RU user /RP password /TR "Disk Backup"
                         /TK \\system\share\ntbackup.exe /EID 4