Back to Event Log Query 1

[WhoKilledKenny]

Barney thanks for your last post.

Here is the issue I am now having and I am puzzled. When executing the code below and usting the strComputer = "." Everything works great on the local machine.
When I try to do the same query on a remote server by changing strComputer = "Servername" I do not get any output from wscript.echo. My dubbuger states no error when running the script. I am a domain admin so I don't believe I am running into any type of permissions issue. Please look at the code and respond with any suggestions. Thanks again everyone...

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")

DateToCheck = Date - 7
dtmEndDate.SetVarDate Date, True
dtmStartDate.SetVarDate DateToCheck, True

Set colEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where TimeWritten >= '" _
& dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")

For Each objEvent in colEvents
If objEvent.Type ="error" Then
WScript.Echo "Event Type: " & objEvent.Type
WScript.Echo "Source: " & objEvent.SourceName
WScript.Echo "User: " & objEvent.User
WScript.Echo "Event Date and Time: " & objEvent.TimeGenerated
Wscript.Echo "Description: " & objEvent.Message
End If
Next

 

[WhoKilledKenny]

OK - Don't know if this is something I missed while reading to gobs of scripting books or just an ugly bug. If someone knows the answer please respond.

Test this out yourselves....

If I run the script about using the local computer:
strComputer = "."
The line under the For Each statment works:
If objEvent.Type ="error" Then

What I want you to pay attention to is the lower case e in the word error. I changed it to Error (Uppercase) and it blew up when using strComputer = "." - But when connecting to a remote server, strComputer = "FileServer" it works with the Uppercase 'Error'. So then I tried the remote with lowercase 'error' and it blew up again?????

Anyone have a logical explination, so I don't kill myself trying to research this.

Thanks again...

 

[PHV]

Have you tried to replace this:
If objEvent.Type ="error" Then
with this ?
If LCase(objEvent.Type) = "error" Then

Hope This Helps, PH.
Want to get great answers to your Tek-Tips questions? Have a look at FAQ219-2884 or FAQ181-2886

 

[strebor]

You may be interested in Log Parser 2.2, free from Microsoft, is a really good tool for accessing and reporting on log files, including event logs. It can be used as a command line tool or called and used from a script (vbscript, etc.) or a programming language such as c#. You can easily construct sql-like queries... more at:

http://www.logparser.com/

strebor

 

[WhoKilledKenny]

Thanks guys for the replies...
I will try your suggestion PHV, but just a bug or any explanation of why?
Strebor I will check out logparser but the code above is a small piece of a server maintenance script I'm building, which has many tasks other than this one. Don't know if I want to complicate things by trying to call logparser from the script.

Thanks again...

 

[WhoKilledKenny]

Strebor... Log Parser 2.2 - Sweeeeeet
Thanks - Have a Star!