Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

WMI SQL Query for Eventlog

Posted on 2009-04-06
3
Medium Priority
?
1,311 Views
Last Modified: 2012-05-06
I would like to receive the last 5 Entries for each EventID in every logfile or at least for one specific logfile

The table I need is Win32_NTLogEvent


0
Comment
Question by:schubduese
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 25

Expert Comment

by:reb73
ID: 24078999
Here's a sample to display the last five records from the application logfile, you can adapt it for the other logfile types -
strComputer = "."
strcrlf = chr(13) & chr(10)
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
 
Set objInstalledLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile Where LogFileName = 'Application'")
 
For Each objLogfile in objInstalledLogFiles
    intRecords = objLogFile.NumberOfRecords
Next
 
Set colLoggedEvents = objWMIService.ExecQuery _
    ("Select * From Win32_NTLogEvent Where Logfile = 'Application' AND " & _
        "RecordNumber > " &  cstr(intRecords - 5))
 
For Each objEvent in colLoggedEvents
    Wscript.Echo "Category: " & objEvent.Category & strcrlf & _
    "Computer Name: " & objEvent.ComputerName  & strcrlf & _
    "Event Code: " & objEvent.EventCode & strcrlf & _
    "Message: " & objEvent.Message & strcrlf & _
    "Record Number: " & objEvent.RecordNumber & strcrlf & _
    "Source Name: " & objEvent.SourceName & strcrlf & _
    "Time Written: " & objEvent.TimeWritten & strcrlf & _
    "Event Type: " & objEvent.Type & strcrlf & _
    "User: " & objEvent.User
Next

Open in new window

0
 

Author Comment

by:schubduese
ID: 24079263
This returns the last  5 entries over all id's right? What if i need the last 5 entries for each event id?
0
 
LVL 25

Accepted Solution

by:
reb73 earned 1500 total points
ID: 24082989
WQL (WMI query Language) does not support either the TOP operator or the ORDER BY Clause, so I'm afraid you will have to capture the results of the basic query and loop through the collection populating a recordset which can then be sorted on EventCode and TimeWritten to give you the top 5 for each event code..


0

Featured Post

[Webinar] Lessons on Recovering from Petya

Skyport is working hard to help customers recover from recent attacks, like the Petya worm. This work has brought to light some important lessons. New malware attacks like this can take down your entire environment. Learn from others mistakes on how to prevent Petya like worms.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I'm trying, I really am. But I've seen so many wrong approaches involving date(time) boundaries I despair about my inability to explain it. I've seen quite a few recently that define a non-leap year as 364 days, or 366 days and the list goes on. …
When you see single cell contains number and text, and you have to get any date out of it seems like cracking our heads.
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question