Solved

WMI SQL Query for Eventlog

Posted on 2009-04-06
3
1,289 Views
Last Modified: 2012-05-06
I would like to receive the last 5 Entries for each EventID in every logfile or at least for one specific logfile

The table I need is Win32_NTLogEvent


0
Comment
Question by:schubduese
  • 2
3 Comments
 
LVL 25

Expert Comment

by:reb73
ID: 24078999
Here's a sample to display the last five records from the application logfile, you can adapt it for the other logfile types -
strComputer = "."
strcrlf = chr(13) & chr(10)
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 
Set objInstalledLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile Where LogFileName = 'Application'")
 
For Each objLogfile in objInstalledLogFiles
    intRecords = objLogFile.NumberOfRecords
Next
 
Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * From Win32_NTLogEvent Where Logfile = 'Application' AND " & _
        "RecordNumber > " &  cstr(intRecords - 5))
 
For Each objEvent in colLoggedEvents
    Wscript.Echo "Category: " & objEvent.Category & strcrlf & _
    "Computer Name: " & objEvent.ComputerName  & strcrlf & _
    "Event Code: " & objEvent.EventCode & strcrlf & _
    "Message: " & objEvent.Message & strcrlf & _
    "Record Number: " & objEvent.RecordNumber & strcrlf & _
    "Source Name: " & objEvent.SourceName & strcrlf & _
    "Time Written: " & objEvent.TimeWritten & strcrlf & _
    "Event Type: " & objEvent.Type & strcrlf & _
    "User: " & objEvent.User
Next

Open in new window

0
 

Author Comment

by:schubduese
ID: 24079263
This returns the last  5 entries over all id's right? What if i need the last 5 entries for each event id?
0
 
LVL 25

Accepted Solution

by:
reb73 earned 500 total points
ID: 24082989
WQL (WMI query Language) does not support either the TOP operator or the ORDER BY Clause, so I'm afraid you will have to capture the results of the basic query and loop through the collection populating a recordset which can then be sorted on EventCode and TimeWritten to give you the top 5 for each event code..


0

Featured Post

Forrester Webinar: xMatters Delivers 261% ROI

Guest speaker Dean Davison, Forrester Principal Consultant, explains how a Fortune 500 communication company using xMatters found these results: Achieved a 261% ROI, Experienced $753,280 in net present value benefits over 3 years and Reduced MTTR by 91% for tier 1 incidents.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I'm trying, I really am. But I've seen so many wrong approaches involving date(time) boundaries I despair about my inability to explain it. I've seen quite a few recently that define a non-leap year as 364 days, or 366 days and the list goes on. …
If you have heard of RFC822 date formats, they can be quite a challenge in SQL Server. RFC822 is an Internet standard format for email message headers, including all dates within those headers. The RFC822 protocols are available in detail at:   ht…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question