Solved

WMI SQL Query for Eventlog

Posted on 2009-04-06
3
1,304 Views
Last Modified: 2012-05-06
I would like to receive the last 5 Entries for each EventID in every logfile or at least for one specific logfile

The table I need is Win32_NTLogEvent


0
Comment
Question by:schubduese
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 25

Expert Comment

by:reb73
ID: 24078999
Here's a sample to display the last five records from the application logfile, you can adapt it for the other logfile types -
strComputer = "."
strcrlf = chr(13) & chr(10)
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 
Set objInstalledLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile Where LogFileName = 'Application'")
 
For Each objLogfile in objInstalledLogFiles
    intRecords = objLogFile.NumberOfRecords
Next
 
Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * From Win32_NTLogEvent Where Logfile = 'Application' AND " & _
        "RecordNumber > " &  cstr(intRecords - 5))
 
For Each objEvent in colLoggedEvents
    Wscript.Echo "Category: " & objEvent.Category & strcrlf & _
    "Computer Name: " & objEvent.ComputerName  & strcrlf & _
    "Event Code: " & objEvent.EventCode & strcrlf & _
    "Message: " & objEvent.Message & strcrlf & _
    "Record Number: " & objEvent.RecordNumber & strcrlf & _
    "Source Name: " & objEvent.SourceName & strcrlf & _
    "Time Written: " & objEvent.TimeWritten & strcrlf & _
    "Event Type: " & objEvent.Type & strcrlf & _
    "User: " & objEvent.User
Next

Open in new window

0
 

Author Comment

by:schubduese
ID: 24079263
This returns the last  5 entries over all id's right? What if i need the last 5 entries for each event id?
0
 
LVL 25

Accepted Solution

by:
reb73 earned 500 total points
ID: 24082989
WQL (WMI query Language) does not support either the TOP operator or the ORDER BY Clause, so I'm afraid you will have to capture the results of the basic query and loop through the collection populating a recordset which can then be sorted on EventCode and TimeWritten to give you the top 5 for each event code..


0

Featured Post

Get proactive database performance tuning online

At Percona’s web store you can order full Percona Database Performance Audit in minutes. Find out the health of your database, and how to improve it. Pay online with a credit card. Improve your database performance now!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes how to use the timestamp of existing data in a database to allow Tableau to calculate the prior work day instead of relying on case statements or if statements to calculate the days of the week.
When you see single cell contains number and text, and you have to get any date out of it seems like cracking our heads.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question