Query archived Windows Event Logs with WMI

Using WMI, how can I harvest events in a backed up event log file? I know how to read the current event log, but don't know how to query one that has been backed up and cleared.

Who is Participating?
Bigjohn-sConnect With a Mentor Commented:
I'm not a WMI scripter.  But I think if you were saving / exporting the data as CSV, you could then use your script to access it.
gwiensxRetiredAuthor Commented:
Well, I guess I wasn't clear about how I wanted to access the archived log. I know I can view the archived events with the event viewer, but I need to do it using a WMI script.
Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

Then you need to archive the events as comma delimited values (CSV).  You can then use any application to access those events - it's just a text file.

gwiensxRetiredAuthor Commented:
Here is the code I use to clear the current Application event log, saving these events to an event file.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='Application'")
For Each objLogfile in colLogFiles
errBackupLog = objLogFile.BackupEventLog("c:\scripts\application.evt")
If errBackupLog <> 0 Then
Wscript.Echo "The Application event log could not be backed up."
End If

What I am looking for is WMI code which would then let me read from this file -- code similar to the code that follows, but point it to the file I created above:

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Application'")
For Each objEvent in colLoggedEvents
Wscript.Echo "Category: " & objEvent.Category
Wscript.Echo "Computer Name: " & objEvent.ComputerName
Wscript.Echo "Event Code: " & objEvent.EventCode
Wscript.Echo "Message: " & objEvent.Message
Wscript.Echo "Record Number: " & objEvent.RecordNumber
Wscript.Echo "Source Name: " & objEvent.SourceName
Wscript.Echo "Time Written: " & objEvent.TimeWritten
Wscript.Echo "Event Type: " & objEvent.Type
Wscript.Echo "User: " & objEvent.User

I have tried modifying the "select" statement above as follows, but his does not work:

("Select * from Win32_NTLogEvent Where Logfile = 'Application' and NTEventlogFile = 'C:\GWiens\Code\WinScripts\EventLog\application.evt'")

gwiensxRetiredAuthor Commented:
My research shows that apparently there is not currently a way to read archived binary event files without additional enhancements such as proprietary extensions, etc.
Thanks for the points.  Sorry the answer was not what you expected.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.