command line results for dcdiag and eventlogs

Brian S
Brian S used Ask the Experts™
on
I'm preparing a script to parse looking for information from DC Diag and eventlogs on a Windows 2008 R2 server.

My question is this how can I via command line search for events in the eventlogs (e.g. EventIDs) and what is the path to dcdiag? I can see that I can just run it via the command line without a path, but if I want to script it I need a path.

any help would be appreaciated.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2011
Commented:
Following is a Vbscript, you can change the eventid you want to check in the query (EventCode=1079)

dcdiag path is not required
'On Error Resume Next

servername="."
Set objWMIService = GetObject("winmgmts:\\" & ServerName & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery("Select * from Win32_NTLogEvent Where EventCode=1079")

For Each objEvent In colLoggedEvents      
    WScript.Echo  objEvent.EventCode &","& WMIStringToDate(objEvent.TimeWritten)
Next    

'DCdiag Test
dcdiagout=""
Set objShell = CreateObject("Wscript.Shell")
dcocommand = "dcdiag /s:"& ServerName

Set objExec = objShell.Exec(dcoCommand) 

dcdiagout=objExec.StdOut.ReadAll()

WScript.Echo "dcdiag " & dcdiagout

Open in new window

Brian Sretired geek

Author

Commented:
Wow that was quick. I'll give that a go.
Top Expert 2011

Commented:
Missed the date conversion
'On Error Resume Next

servername="."
Set objWMIService = GetObject("winmgmts:\\" & ServerName & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery("Select * from Win32_NTLogEvent Where EventCode=1079")

For Each objEvent In colLoggedEvents      
    WScript.Echo  objEvent.EventCode &","& WMIStringToDate(objEvent.TimeWritten)
Next    

'DCdiag Test
dcdiagout=""
Set objShell = CreateObject("Wscript.Shell")
dcocommand = "dcdiag /s:"& ServerName

Set objExec = objShell.Exec(dcoCommand) 

dcdiagout=objExec.StdOut.ReadAll()

WScript.Echo "dcdiag " & dcdiagout

Function WMIStringToDate(dtmDate)
    WMIStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
    Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
    & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function

Open in new window

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial