Solved

WMI SQL Query for Eventlog

Posted on 2009-04-06
3
1,285 Views
Last Modified: 2012-05-06
I would like to receive the last 5 Entries for each EventID in every logfile or at least for one specific logfile

The table I need is Win32_NTLogEvent


0
Comment
Question by:schubduese
  • 2
3 Comments
 
LVL 25

Expert Comment

by:reb73
ID: 24078999
Here's a sample to display the last five records from the application logfile, you can adapt it for the other logfile types -
strComputer = "."
strcrlf = chr(13) & chr(10)
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 
Set objInstalledLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile Where LogFileName = 'Application'")
 
For Each objLogfile in objInstalledLogFiles
    intRecords = objLogFile.NumberOfRecords
Next
 
Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * From Win32_NTLogEvent Where Logfile = 'Application' AND " & _
        "RecordNumber > " &  cstr(intRecords - 5))
 
For Each objEvent in colLoggedEvents
    Wscript.Echo "Category: " & objEvent.Category & strcrlf & _
    "Computer Name: " & objEvent.ComputerName  & strcrlf & _
    "Event Code: " & objEvent.EventCode & strcrlf & _
    "Message: " & objEvent.Message & strcrlf & _
    "Record Number: " & objEvent.RecordNumber & strcrlf & _
    "Source Name: " & objEvent.SourceName & strcrlf & _
    "Time Written: " & objEvent.TimeWritten & strcrlf & _
    "Event Type: " & objEvent.Type & strcrlf & _
    "User: " & objEvent.User
Next

Open in new window

0
 

Author Comment

by:schubduese
ID: 24079263
This returns the last  5 entries over all id's right? What if i need the last 5 entries for each event id?
0
 
LVL 25

Accepted Solution

by:
reb73 earned 500 total points
ID: 24082989
WQL (WMI query Language) does not support either the TOP operator or the ORDER BY Clause, so I'm afraid you will have to capture the results of the basic query and loop through the collection populating a recordset which can then be sorted on EventCode and TimeWritten to give you the top 5 for each event code..


0

Featured Post

DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Not long ago I saw a question in the VB Script forum that I thought would not take much time. You can read that question (Question ID  (http://www.experts-exchange.com/Programming/Languages/Visual_Basic/VB_Script/Q_28455246.html)28455246) Here (http…
PL/SQL can be a very powerful tool for working directly with database tables. Being able to loop will allow you to perform more complex operations, but can be a little tricky to write correctly. This article will provide examples of basic loops alon…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question