How to read the NT Event Log?

[jimmYLepp]

Using WBS on an NT 4.0 server, I am trying to create a script that will check for new error events every ten minutes. How would I access the NT Event Viewer, the population file seems to be encrypted.

Thanks

jimmY

 

[DanaHallenbeck]

The only way I know if is using WMI. A sample script is listed below...I also included the available properties for the Win32_NTLogEvent object

'properties for Win32_NTLogEvent
' uint16 Category;
' string CategoryString;
' string ComputerName;
' uint8 Data[];
' uint16 EventCode;
' uint32 EventIdentifier;
' uint8 EventType;
' string InsertionStrings[];
' string Logfile;
' string Message;
' uint32 RecordNumber;
' string SourceName;
' datetime TimeGenerated;
' datetime TimeWritten;
' string Type;
' string User;

Dim i, compname

compname = &quot;<computername here>&quot;

Set events = GetObject(&quot;winmgmts:{impersonationLevel=impersonate}!&quot; & compname).ExecQuery(&quot;SELECT * FROM Win32_NTLogEvent WHERE Logfile='application'&quot 'or system or security
For Each i In events
WScript.Echo(i.eventcode)
WScript.Echo(i.message)
next

 

[jimmYLepp]

Thanks for the help.

 

[mrmovie]

if you want your server to notify you when i has new event logs you can set up permement event notification using WMI.
alternatively you could have a vbs running on the each server which has registered with WMI for event notification and using async event notification. havent got an example on me today

 

[mrmovie]

actually, i cant remember if the eventlogs provider supports this. if it doesnt you can still do it from the server side by polling every 10 minutes to see if anything has changed. that was you wont have to worry about comparing times of eventlog entries etc etc. i will have a read tonight and post an example, it might clarify what the hell i am talking about ( i dont seem to know).
richard

 

[mrmovie]

ok example from MS on how to wait for an event.
the &quot;WITHIN&quot; is used as the win32_process provider doesnt support (whats the word im looking for) immediate notification of events and you have to poll. the 10 are seconds. change the 'Win32_Process' to Win32_NTLogEvent, as suggested above (i think you can also forget about the WITHIN clause) and whenever a new Win32_NTLogEvent occurs the commands in the Sub will run. you can filter for types of events (application, system etc) and also the eventid so you can do different things

strComputer = &quot;.&quot;
Set objWMIService = GetObject(&quot;winmgmts:&quot; _
& &quot;{impersonationLevel=impersonate}!\\&quot; & strComputer & &quot;\root\cimv2&quot

Set MySink = WScript.CreateObject(&quot;WbemScripting.SWbemSink&quot;,&quot;SINK_&quot

WMIservices.ExecNotificationQueryAsync Sink, &quot;SELECT * FROM __InstanceDeletionEvent&quot; & _
&quot;WITHIN 10 WHERE TargetInstance ISA 'Win32_Process'&quot;

WScript.Echo &quot;Waiting for events...&quot;

Sub SINK_OnObjectReady(objObject, objAsyncContext)
WScript.Echo (objObject.TargetInstance.Name)
End Sub

 

[Smithsco]

Does anyone have anything that will do the security logs?
When I do the following it will only spit out Application and System logs.

On Error Resume Next
strComputer = &quot;.&quot;
Set objWMIService = GetObject(&quot;winmgmts:\\&quot; & strComputer & &quot;\root\cimv2&quot
Set colItems = objWMIService.ExecQuery(&quot;Select * from Win32_NTLogEvent&quot;,,48)
For Each objItem in colItems
wtf.writeline objItem.Logfile
next