Solved

WMI query cannot extract event message

Posted on 2011-03-09
14
1,208 Views
Last Modified: 2012-05-11
Hi there

My WMI query renders the events in the local hosts but returns null for every event message from any remote server. Other fields, such as event code or computername have no problemes, only the event message (which can be rather long)

I attach my connecting string

Is there any workaround?

Thanks
Set wbemLocator = CreateObject("wbemscripting.swbemlocator")
    Set objWMIService = wbemLocator.ConnectServer(strComputer, , strUser, strPassword)

Open in new window

0
Comment
Question by:Pakhu1
  • 7
  • 6
14 Comments
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 35081348
You have to provide a namespace
Set wbemLocator = CreateObject("wbemscripting.swbemlocator")
    Set objWMIService = wbemLocator.ConnectServer(strComputer, "root\CIMV2" , strUser, strPassword)
0
 
LVL 2

Expert Comment

by:khaaz
ID: 35082929
What appens if you try this directly from a command line

WMIC /NODE:192.168.0.1 /USER:domain\user /password:password PATH Win32ntlogevent Where (Type='Error' and Logfile='System') get message

Open in new window


Do you have anything displayed ?
0
 

Author Comment

by:Pakhu1
ID: 35092947
Roads_Roads: I provided the namespace and I keep getting null content messages. There is no difference


khaaz: I've got an "no valid class" error


Thanks

0
 
LVL 2

Expert Comment

by:khaaz
ID: 35093027
I've misspelled the class name
could you try with win32_ntlogevent
0
 

Author Comment

by:Pakhu1
ID: 35125998
Hi khaaz:


Sorry for the delay. I missed your comment.

Your idea works fine. Now, my problem is how I must redesign my code in order to get the information, instead of using a command line

Thanks
0
 
LVL 2

Expert Comment

by:khaaz
ID: 35126122
Hi Pakhu1,
 

   Now we know that the message attribute can be retrieved and you don't have any rights or access issues. You did copy/paste only thee connection string which seems to be good, what's your code ?

Khaaaz
0
 

Author Comment

by:Pakhu1
ID: 35129433
Hi there:

It looks like you are on the right track.

Find the code attached


Thank you
Set wbemLocator = CreateObject("wbemscripting.swbemlocator")
Set objWMIService = wbemLocator.ConnectServer(strComputer, "root\CIMV2", strUser, strPassword)

      
Set colRetrievedEvents = objWMIService.ExecQuery _
     ("SELECT * FROM Win32_NTLogEvent Where TimeWritten >= '" & FechaIni & "' AND SourceName = '" & RST("Servicio") & "'", , 48)
        
            For Each objEvent In colRetrievedEvents

Open in new window

0
Do email signature updates give you a headache?

Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

 
LVL 2

Expert Comment

by:khaaz
ID: 35129640
The code seems fine, what if you try with :
         ("SELECT TimeWritten,SourceName,Message FROM Win32_NTLogEvent Where TimeWritten >= '" & FechaIni & "' AND SourceName = '" & RST("Servicio") & "'", , 48) 

Open in new window


and then wscript.echo objevent.message or something like that ?

0
 
LVL 2

Expert Comment

by:khaaz
ID: 35129684
and did you try  without the 48 flag ? :

 ("SELECT * FROM Win32_NTLogEvent Where TimeWritten >= '" & FechaIni & "' AND SourceName = '" & RST("Servicio") & "'")

Open in new window

0
 

Author Comment

by:Pakhu1
ID: 35129823
Yes I tryed both ways and the resulta is exactly the same

The funny think is that the code works fine for a server in my building, but not for servers that are in the same area but some kilometers away.

Now I'm running the code with the new SELECT clause. It takes a while...
0
 

Author Comment

by:Pakhu1
ID: 35129927
Well,I get the same result:

for the remote servers I get all fields right (type, TimWriteen). Al of them but Message that is still null in all cases
0
 
LVL 2

Expert Comment

by:khaaz
ID: 35137598
The funny think is that the code works fine for a server in my building, but not for servers that are in the same area but some kilometers away.


So I think we should investigate that way, same OS and service pack version ?
could you try on a non working server to recompile ntevt.mof with :

C:\Windows\System32\wbem>mofcomp ntevt.mof

Open in new window

0
 

Author Comment

by:Pakhu1
ID: 35145825
Hi there


Sorry for he dealay. I was out of the offiice

Running this command I get the error 0x80041003 regarding WMI


Thanks
C:\Windows\System32\wbem>mofcomp ntevt.mof
Microsoft (R) MOF Compiler Version 6.1.7601.17514
Copyright (c) Microsoft Corp. 1997-2006. Reservados todos los derechos.
Analizando el archivo MOF: ntevt.mof
El archivo MOF se analizó correctamente
Almacenando información en el repositorio...
Error al procesar el elemento 1 definido en las líneas 8 - 11 en el archivo ntev
t.mof:
Número de error: 0x80041003, facilidad: WMI
Descripción: Acceso denegado
El compilador ha devuelto el error 0x80041003
C:\Windows\System32\wbem>cd..

Open in new window

0
 
LVL 2

Accepted Solution

by:
khaaz earned 500 total points
ID: 35145862
this is an "access denied" like error, check the account that launched the command.
try with a right click "run as administrator" on the cmd shrotcut
it could just be an annoying UAC issue.

As hard as we try, it will work one day :)
Khaaaz
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Several part series to implement Internet Explorer 11 Enterprise Mode
Recently Microsoft released a brand new function called CONCAT. It's supposed to replace its predecessor CONCATENATE. But how does it work? And what's new? In this article, we take a closer look at all of this - we even included an exercise file for…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now