Q. How can I use the /AUXSOURCE switch to translate Event log messages like 'The description for Event ID ( ) in Source ( ) cannot be found'?

The proper use of the /AUXSOURCE switch can translate an event like:

The description for Event ID ( 1202 ) in Source ( ClusSvc ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. One may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: SAMMCPQCLU2, SAMMCPQCLU1, -4662149.

into a more usable message like:

The time delta between node SAMMCPQCLU2 and node SAMMCPQCLU1 is -4662149(in 100 nanosecs).For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

The /AUXSOURCE switch allows you to view saved .evt files from Windows Server 2003 and Windows XP, event if the saved event log is on a remote computer for which you do not have administrative privileges, or on a remote computer on which the Remote Registry Service is not running, or if the local computer doesn't include the log type, like DNS, Active Directory, and FRS.

NOTE: You can view the log output of a Windows 2000 computer from a Windows XP computer.

To use the /AUXSOURCE, start Event Viewer like:

mmc /a eventvwr.msc /auxsource=

Where is the NetBIOS name, FQDN (Fully Qualified Domain Name), or IP address of a computer that is running the Remote Registry Service and contains all of the software and the operating system components that the problematic computer contains, or it can be the computer from which the event log was saved. You must be able to access the registry on as an administrator. If you are not logged onto as an administrator, you can use RunAs, or you can connect to the IPC$ administrative share with a command like:

net use \ipc$ /u:domainnameusername *