Solved

Query archived Windows Event Logs with WMI

Posted on 2003-11-01
7
494 Views
Last Modified: 2010-04-13
Using WMI, how can I harvest events in a backed up event log file? I know how to read the current event log, but don't know how to query one that has been backed up and cleared.

Thanks.
0
Comment
Question by:gwiensx
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 2

Expert Comment

by:Bigjohn-s
ID: 9664860
0
 

Author Comment

by:gwiensx
ID: 9664963
Well, I guess I wasn't clear about how I wanted to access the archived log. I know I can view the archived events with the event viewer, but I need to do it using a WMI script.
0
 
LVL 2

Expert Comment

by:Bigjohn-s
ID: 9666046
Then you need to archive the events as comma delimited values (CSV).  You can then use any application to access those events - it's just a text file.

John
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 

Author Comment

by:gwiensx
ID: 9666785
Here is the code I use to clear the current Application event log, saving these events to an event file.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='Application'")
For Each objLogfile in colLogFiles
errBackupLog = objLogFile.BackupEventLog("c:\scripts\application.evt")
If errBackupLog <> 0 Then
Wscript.Echo "The Application event log could not be backed up."
Else
objLogFile.ClearEventLog()
End If
Next


What I am looking for is WMI code which would then let me read from this file -- code similar to the code that follows, but point it to the file I created above:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Application'")
For Each objEvent in colLoggedEvents
Wscript.Echo "Category: " & objEvent.Category
Wscript.Echo "Computer Name: " & objEvent.ComputerName
Wscript.Echo "Event Code: " & objEvent.EventCode
Wscript.Echo "Message: " & objEvent.Message
Wscript.Echo "Record Number: " & objEvent.RecordNumber
Wscript.Echo "Source Name: " & objEvent.SourceName
Wscript.Echo "Time Written: " & objEvent.TimeWritten
Wscript.Echo "Event Type: " & objEvent.Type
Wscript.Echo "User: " & objEvent.User
Next

I have tried modifying the "select" statement above as follows, but his does not work:

("Select * from Win32_NTLogEvent Where Logfile = 'Application' and NTEventlogFile = 'C:\GWiens\Code\WinScripts\EventLog\application.evt'")

0
 
LVL 2

Accepted Solution

by:
Bigjohn-s earned 500 total points
ID: 9667025
I'm not a WMI scripter.  But I think if you were saving / exporting the data as CSV, you could then use your script to access it.
0
 

Author Comment

by:gwiensx
ID: 9679939
My research shows that apparently there is not currently a way to read archived binary event files without additional enhancements such as proprietary extensions, etc.
0
 
LVL 2

Expert Comment

by:Bigjohn-s
ID: 9680206
Thanks for the points.  Sorry the answer was not what you expected.
0

Featured Post

Secure Your Active Directory - April 20, 2017

Active Directory plays a critical role in your company’s IT infrastructure and keeping it secure in today’s hacker-infested world is a must.
Microsoft published 300+ pages of guidance, but who has the time, money, and resources to implement? Register now to find an easier way.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows 2000 Kerberos problem 5 348
Windows 8 in a W2K Domain 7 592
Migrate Windows NT to Windows 2003 2 523
Corrupted W2K  serverregistry 2 160
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Read the original post on Monitis Blog. Believe it or not, the most important thing about the website of your business is not what’s on it but how fast it loads. Yes, that’s right!    As you can see on this infographic (an oldie but goodie!), …
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question