Event Log Time Period Check

Question

Event Log Time Period Check

Program Jim (Systems Engineer)

(OP)

21 Nov 18 16:32

Hi,

I have developed a script that looks for a certain Windows Backup failure attempt.

My issue is the failure event could be anytime from 18:00 to 06:00 the next morning, the script at the moment grabs all the events from the event log & writes it to a text file and emails it out.

Personally i would like the script to only take the first failure and write this to the text file rather than pull all events back.

At the moment i am testing from my PC so the event i am searching for is different to the purpose:

CODE --> VBS

' ———————————————————–'
Option Explicit

Dim objFSO, objFolder, objFile, objWMI, objItem, objMail, objConf, objFlds ' Objects
Dim strComputer, strFileName, strFileOpen, strFolder, strPath, strCompName, dtmYesterday
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents, wshNetwork
Set wshNetwork = CreateObject( "WScript.Network" )
strCompName = wshNetwork.ComputerName
' ——————————————————–
' Set the folder and file name
strComputer = "."
strFileName = "\Event916.txt"
strFolder = "C:\logs"
strPath = strFolder & strFileName

' Set numbers & date config
intNumberID = 916 '517 ' Event ID Number
intRecordNum = 0
dtmYesterday = "20181120172224.893754-000"
'dtmtoday = Date()


'WMI Conversion Functions
'Convert To WMIDate\Time
Function ConvertToWMIDateTime(dDateTime) 
    On Error Resume Next  
    Dim oDateTime 
    Set oDateTime = CreateObject("WbemScripting.SWbemDateTime") 
    oDateTime.SetVarDate dDateTime, True  
    ConvertToWMIDateTime = oDateTime.Value 
    Set oDateTime = Nothing 
End Function 
'WmiDate To Date\time
Function WmiDateToDatetime (wmidate) 
    Dim y, m, d, h, mn, s 
    If VarType(wmidate) <> vbString Then 
        WmiDateToDatetime = "Undefined!": Exit Function 
    End If 
    If Len(wmidate) < 15 Or Mid(wmidate, 15,1) <> "." Then 
        WmiDateToDatetime = "Undefined!": Exit Function 
    End If 
    y = Left(wmidate, 4)    ' year 
    m = Mid(wmidate, 5, 2)    ' month 
    d = Mid(wmidate, 7, 2)    ' day 
    h = Mid(wmidate, 9, 2)    ' hours 
    mn = Mid(wmidate, 11, 2) ' minutes 
    s = Mid(wmidate, 13, 2)    ' seconds 
    If y < 1980 Or m < 1 Or d < 1 Then 
        WmiDateToDatetime = "Undefined!": Exit Function 
    End If 
    WmiDateToDatetime =FormatDateTime(DateSerial (y, m, d), VbLongdate) & " - " & FormatDateTime(TimeSerial(h, mn, s), vbLongTime)
'FormatDateTime(DateSerial (y, m, d), VbLongdate) & " - " &	
End Function



' —————————————————–
' Section to create folder and hold file.
' Create the File System Object

Set objFSO = CreateObject("Scripting.FileSystemObject")

' Check that the strFolder folder exists
If objFSO.FolderExists(strFolder) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFolder = objFSO.CreateFolder(strFolder)
'WScript.Echo "Just created " & strFolder
End If

If objFSO.FileExists(strFolder & strFileName) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFile = objFSO.CreateTextFile(strFolder & strFileName)
'Wscript.Echo "Just created " & strFolder & strFileName
End If
' ————————————————–
' Two tiny but vital commands (Try script without)
set objFile = nothing
set objFolder = nothing

' —————————————————-
' Write the information to the file
'Wscript.Echo " Press OK and Wait 30 seconds (ish)"
Set strFileOpen = objFSO.CreateTextFile(strPath, True)

' ———————————————————-
' WMI Core Section
Set objWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery("Select * from Win32_NTLogEvent Where Logfile = 'Application'") 

' ———————————————————-
' Next section loops through ID properties
'Wscript.echo "date:- " & dtmYesterday
'Wscript.echo "dateinWMI:- " & ConvertToWMIDateTime(dtmYesterday)
For Each objItem in colLoggedEvents
'wscript.echo "Converted Date:- " & WmiDateToDatetime(objItem.TimeGenerated)
'wscript.Echo "WMI TIME:- " & objItem.TimeGenerated
If objItem.EventCode = intNumberID And WmiDateToDatetime(objItem.TimeGenerated) = dtmYesterday  Then
strFileOpen.WriteLine("Category: " & objItem.Category & " string " & objItem.CategoryString)
strFileOpen.WriteLine("ComputerName: " & objItem.ComputerName)
strFileOpen.WriteLine("Logfile: " & objItem.Logfile & " source " & objItem.SourceName)
strFileOpen.WriteLine("Logged: " & WmiDateToDatetime(objItem.TimeGenerated))
strFileOpen.WriteLine("EventCode: " & objItem.EventCode)
strFileOpen.WriteLine("EventType: " & objItem.EventType)
strFileOpen.WriteLine("Type: " & objItem.Type)
strFileOpen.WriteLine("User: " & objItem.User)
strFileOpen.WriteLine("Message: " & objItem.Message)
strFileOpen.WriteLine (" ")
intRecordNum = intRecordNum +1
End If

Next

I am struggling with searching for the event as dtmyesterday is looking for one event not between a time frame on 18:00 to 06:00 the next morning for example.
Hopefully i am not trying to push my script beyond the length of VB's capabilities. But i am stumped on getting the time period written or worked out.

All help and thoughts\comments are appreciated.

Kind regards

James

SkipVought (Programmer) · Answer 1 · 2018-11-21 17:11:22

Hi,

Quote:
Personally i would like the script to only take the first failure and write this to the text file rather than pull all events back.

Assign a boolean flag like bHasFailed, that is assigned TRUE when an event occurs and FALSE at 0600 hours.

Then code your failure code to only process any If bHasFailed = FALSE Then

Skip,
_{Just traded in my OLD subtlety...

for a NUance!}

Come Join Us!

Posting Guidelines

Event Log Time Period Check