Read xml file, and execute command

' Text file I/O constants
Const ForReading = 1
Const ForWriting = 2
Const ForAppending = 8

' Data structure for event file info stored in LOG file
Class LogInfo
  Public ArchiveFile
  Public CountStarted
  Public CountEnded
  Public LastEvent
End Class

' Define output log file location, and command to execute
strLogFile = "log.txt"

' Define tags that surround the "key" to each event record, so that we can find just new entries
strEventIdStart = "<EventRecordID>"
strEventIdEnd = "</EventRecordID>"

' Define a few needed objects
Set objShell = WScript.CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")

' MAIN LOGIC : If log file exists, process it, otherwise just create it
If objFSO.FileExists(strLogFile) Then
   ProcessLog(strLogFile)
Else
   CreateLog(strLogFile)
End If

' Done
Wscript.Quit

' Subroutine to process the log file and archive any new events
Sub ProcessLog(strFile)
   ' Load LOG file contents into a dictionary
   Set dicLogInfo = ReadControl(strFile)

   ' Loop through each event file to process
   For Each strKey In dicLogInfo

      ' Check if any events exist, skip empty event logs
      If RecordCountLog(strKey) > 0 Then

         ' Update the LOG file on disk indicating we are starting this event file
         dicLogInfo.Item(strKey).CountStarted = dicLogInfo.Item(strKey).CountStarted + 1
         WriteControl strFile, dicLogInfo

         ' Open the archive file for this event log, append to it if already exists
         Set objLogFile = objFSO.OpenTextFile(dicLogInfo.Item(strKey).ArchiveFile, ForAppending, True)

         ' Query the event file for any events since the last time we checked
         Set objExec = objShell.Exec("wevtutil qe """ & strKey & """ /q:""*[System [(EventRecordID>" & dicLogInfo.Item(strKey).LastEvent & ")]]""")
         lngLastEvent = -1

         ' Process each new event, adding it to archive file, and saving the last event id we processed
         Do While Not objExec.Stdout.atEndOfStream
            strOutput = objExec.StdOut.ReadLine()
            intEventIdStart = InStr(1, strOutput, strEventIdStart, vbTextCompare)
            If intEventIdStart > 0 Then
               intEventIdEnd = InStr(intEventIdStart, strOutput, strEventIdEnd, vbTextCompare)
               intDataOffset = intEventIdStart + Len(strEventIdStart)
               intDataLength = intEventIdEnd - intDataOffset
               lngLastEvent = CLng(Mid(strOutput, intDataOffset, intDataLength))
            End If
            objLogFile.WriteLine strOutput
         Loop

         ' Done with this event log, close the archive file
         objLogFile.Close
         Set objLogFile = Nothing

         ' Update the LOG file on disk indicating we finished this event file, and the last event id processed
         dicLogInfo.Item(strKey).CountEnded = dicLogInfo.Item(strKey).CountEnded + 1
         If lngLastEvent <> -1 Then
            dicLogInfo.Item(strKey).LastEvent = lngLastEvent
         End If
         WriteControl strFile, dicLogInfo
      Else
         ' Update the LOG file on disk indicating we started and finished this event file (since it's empty nothing to do)
         dicLogInfo.Item(strKey).CountStarted = dicLogInfo.Item(strKey).CountStarted + 1
         dicLogInfo.Item(strKey).CountEnded = dicLogInfo.Item(strKey).CountEnded + 1
         WriteControl strFile, dicLogInfo
      End If

   Next
End Sub

' Function to return the number of entries in a specified event file
Function RecordCountLog(strKey)
   lngCount = 0

   ' Query the even log and extract the count of records in it
   Set objExec = objShell.Exec("wevtutil gli """ & strKey & """")
   Do While Not objExec.Stdout.atEndOfStream
      strOutput = objExec.StdOut.ReadLine()
      If Left(strOutput, Len("numberOfLogRecords:")) = "numberOfLogRecords:" Then
         lngCount = CLng(Replace(strOutput, "numberOfLogRecords: ", ""))
      End If
   Loop

   RecordCountLog = lngCount
End Function

' Subroutine to create the initial LOG file containing all event files
Sub CreateLog(strLog)
   Set objLogFile = objFSO.OpenTextFile(strLog, ForWriting, True)

   Set objExec = objShell.Exec("wevtutil el")
   Do While Not objExec.Stdout.atEndOfStream
      strOutput = objExec.StdOut.ReadLine()
      strOutput = strOutput & "," & Replace(strOutput, "/", "_") & ".txt,0,0,0"
      objLogFile.WriteLine strOutput
   Loop

   objLogFile.Close
   Set objLogFile = Nothing
End Sub

' Function to load the LOG file into a dictionary
Function ReadControl (strFile)
   Set dicLogs = CreateObject("Scripting.Dictionary")

   Set objFile = objFSO.OpenTextFile(strFile, ForReading, False, TriStateUseDefault)
   strData = objFile.ReadAll
   objFile.Close

   arrLine = Split(strData, vbCrLf)

   For Each strLine In arrLine
      If strLine <> "" Then
         set objLogInfo = New LogInfo
         arrField = Split(strLine, ",")
         objLogInfo.ArchiveFile = arrField(1)
         objLogInfo.CountStarted = arrField(2)
         objLogInfo.CountEnded = arrField(3)
         objLogInfo.LastEvent = arrField(4)
         dicLogs.Add arrField(0), objLogInfo
      End If
   Next

   Set ReadControl = dicLogs
End Function

' Subroutine to write out the dictionary to the LOG file
Sub WriteControl (strFile, dicLogInfo)
   Set objFile = objFSO.OpenTextFile(strFile, ForWriting, True)
   strData = ""

   For Each strKey In dicLogInfo
      strData = strData & strKey & "," & dicLogInfo.Item(strKey).ArchiveFile & "," & dicLogInfo.Item(strKey).CountStarted & "," & dicLogInfo.Item(strKey).CountEnded & "," & dicLogInfo.Item(strKey).LastEvent & vbCrLf
   Next

   objFile.Write strData

   objFile.Close
End Sub

Select all Open in new window