Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

WMI query cannot extract event message

Posted on 2011-03-09
14
Medium Priority
?
1,301 Views
Last Modified: 2012-05-11
Hi there

My WMI query renders the events in the local hosts but returns null for every event message from any remote server. Other fields, such as event code or computername have no problemes, only the event message (which can be rather long)

I attach my connecting string

Is there any workaround?

Thanks
Set wbemLocator = CreateObject("wbemscripting.swbemlocator")
    Set objWMIService = wbemLocator.ConnectServer(strComputer, , strUser, strPassword)

Open in new window

0
Comment
Question by:Pakhu1
  • 7
  • 6
14 Comments
 
LVL 27

Expert Comment

by:Lukasz Chmielewski
ID: 35081348
You have to provide a namespace
Set wbemLocator = CreateObject("wbemscripting.swbemlocator")
    Set objWMIService = wbemLocator.ConnectServer(strComputer, "root\CIMV2" , strUser, strPassword)
0
 
LVL 2

Expert Comment

by:khaaz
ID: 35082929
What appens if you try this directly from a command line

WMIC /NODE:192.168.0.1 /USER:domain\user /password:password PATH Win32ntlogevent Where (Type='Error' and Logfile='System') get message

Open in new window


Do you have anything displayed ?
0
 

Author Comment

by:Pakhu1
ID: 35092947
Roads_Roads: I provided the namespace and I keep getting null content messages. There is no difference


khaaz: I've got an "no valid class" error


Thanks

0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 2

Expert Comment

by:khaaz
ID: 35093027
I've misspelled the class name
could you try with win32_ntlogevent
0
 

Author Comment

by:Pakhu1
ID: 35125998
Hi khaaz:


Sorry for the delay. I missed your comment.

Your idea works fine. Now, my problem is how I must redesign my code in order to get the information, instead of using a command line

Thanks
0
 
LVL 2

Expert Comment

by:khaaz
ID: 35126122
Hi Pakhu1,
 

   Now we know that the message attribute can be retrieved and you don't have any rights or access issues. You did copy/paste only thee connection string which seems to be good, what's your code ?

Khaaaz
0
 

Author Comment

by:Pakhu1
ID: 35129433
Hi there:

It looks like you are on the right track.

Find the code attached


Thank you
Set wbemLocator = CreateObject("wbemscripting.swbemlocator")
Set objWMIService = wbemLocator.ConnectServer(strComputer, "root\CIMV2", strUser, strPassword)

      
Set colRetrievedEvents = objWMIService.ExecQuery _
     ("SELECT * FROM Win32_NTLogEvent Where TimeWritten >= '" & FechaIni & "' AND SourceName = '" & RST("Servicio") & "'", , 48)
        
            For Each objEvent In colRetrievedEvents

Open in new window

0
 
LVL 2

Expert Comment

by:khaaz
ID: 35129640
The code seems fine, what if you try with :
         ("SELECT TimeWritten,SourceName,Message FROM Win32_NTLogEvent Where TimeWritten >= '" & FechaIni & "' AND SourceName = '" & RST("Servicio") & "'", , 48) 

Open in new window


and then wscript.echo objevent.message or something like that ?

0
 
LVL 2

Expert Comment

by:khaaz
ID: 35129684
and did you try  without the 48 flag ? :

 ("SELECT * FROM Win32_NTLogEvent Where TimeWritten >= '" & FechaIni & "' AND SourceName = '" & RST("Servicio") & "'")

Open in new window

0
 

Author Comment

by:Pakhu1
ID: 35129823
Yes I tryed both ways and the resulta is exactly the same

The funny think is that the code works fine for a server in my building, but not for servers that are in the same area but some kilometers away.

Now I'm running the code with the new SELECT clause. It takes a while...
0
 

Author Comment

by:Pakhu1
ID: 35129927
Well,I get the same result:

for the remote servers I get all fields right (type, TimWriteen). Al of them but Message that is still null in all cases
0
 
LVL 2

Expert Comment

by:khaaz
ID: 35137598
The funny think is that the code works fine for a server in my building, but not for servers that are in the same area but some kilometers away.


So I think we should investigate that way, same OS and service pack version ?
could you try on a non working server to recompile ntevt.mof with :

C:\Windows\System32\wbem>mofcomp ntevt.mof

Open in new window

0
 

Author Comment

by:Pakhu1
ID: 35145825
Hi there


Sorry for he dealay. I was out of the offiice

Running this command I get the error 0x80041003 regarding WMI


Thanks
C:\Windows\System32\wbem>mofcomp ntevt.mof
Microsoft (R) MOF Compiler Version 6.1.7601.17514
Copyright (c) Microsoft Corp. 1997-2006. Reservados todos los derechos.
Analizando el archivo MOF: ntevt.mof
El archivo MOF se analizó correctamente
Almacenando información en el repositorio...
Error al procesar el elemento 1 definido en las líneas 8 - 11 en el archivo ntev
t.mof:
Número de error: 0x80041003, facilidad: WMI
Descripción: Acceso denegado
El compilador ha devuelto el error 0x80041003
C:\Windows\System32\wbem>cd..

Open in new window

0
 
LVL 2

Accepted Solution

by:
khaaz earned 2000 total points
ID: 35145862
this is an "access denied" like error, check the account that launched the command.
try with a right click "run as administrator" on the cmd shrotcut
it could just be an annoying UAC issue.

As hard as we try, it will work one day :)
Khaaaz
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Know the reasons and solutions to move/import EDB to New Exchange Server. Also, find out how to recover an Exchange .edb file and to restore the file back.
The article covers five tools all IT professionals should know about, as they up productivity by a great deal!
In this video, viewers are given an introduction to using the Windows 10 Snipping Tool, how to quickly locate it when it's needed and also how make it always available with a single click of a mouse button, by pinning it to the Desktop Task Bar. Int…
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…

971 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question