about event viewer id log

[brlissab]

hello
i'm working on logs on wk3 server and i am searching for a way to search some id events on event vwer and those selected will be write on a text file..
here is my code

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFso.createTextFile("C:\scripts\LogID.txt")

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where Logfile = 'Application'")

For Each objEvent in colLoggedEvents
            if ErrorEvent(objEvent) Then
        objFile.WriteLine   ("Event Code: ") & objEvent.EventCode & vbCrlf & _
        objFile.WriteLine  ("Event Type: ") & objEvent.Type & vbCrlf & _
        objFile.WriteLine ("Message: ") & objEvent.Message
End If
Next

Function ErrorEvent(eventid)
 objectEvent=False
If objEvent.Type(param)="Error" Then
Set objEvent=True
End If
End Function

yeah it is not very developped, actually im also looking to
repair these errors, browsing technet for eventually a list of these event id on my wk3 server...if someone nows something about it glad to know..
feel free to comment my code
thanks

 

[tsuji]

Drop the ErrorEvent(eventid) function. It is so wrong. In the main, replace the line
>[tt]if ErrorEvent(objEvent) Then[/tt]
by this
[tt]if objEvent.eventtype=1 then[/tt]

 

[tsuji]

Also ending the writeline with "& _" is wrong syntactically. And vbcrlf preceding it is not needed until you want to separate line by a blank line.
>[tt] objFile.WriteLine ("Event Code: ") & objEvent.EventCode [red]& vbCrlf & _[/red][/tt]
[tt] objFile.WriteLine "Event Code: " & objEvent.EventCode [/tt]
etc...

 

[brlissab]

i give a try on, but nothing...

set objFso = createObject("Scripting.FileSystemObject")
set objFile = objFso.CreateTextFile("d:scripts\logID.txt")

strComputer = "."
set objWMIService = GetObject("winmgmts:" _
        & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
        
        Set colLoggedEvents = objWMIService.ExecQuery _
        ("Select * from Win32_NTLogEvent Where Logfile = 'Application'")
        
        For Each objEvent in colLoggedEvents
        if objEvent.eventype=1 Then
        objFile.WriteLine   "Event Code: " & objEvent.EventCode
        objFile.WriteLine   "Event type: " & objEvent.Type
End IF
Next

and sorry for my first code, i've been scripting vbs a bit, but wmi(heard about it before...)only since couple days..
need to have some info to work on it first i think..

 

[PHV]

Have a look here:

http://msdn.microsoft.com/library/en-us/wmisdk/wmi/win32_ntlogevent.asp

http://msdn.microsoft.com/library/en-us/script56/html/af4423b2-4ee8-41d6-a704-49926cd4d2e8.asp

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[tsuji]

My line
[tt] if objEvent.eventtype=1 then[/tt]
Your line
[tt] if objEvent.eventype=1 Then[/tt]
What is the material difference?

 

[markdmac]

And I'd suggest that you take a look at Microsoft Operations Manager which is designed to do this and so much more.

http://www.microsoft.com/mom/default.mspx

I hope you find this post helpful.

Regards,

Mark