The VBScript Network and Systems Administrator's Cafe

Jan 2 2009   3:01AM GMT

Searching the Windows Eventlog for specific events with WMI

Jerry Lees Jerry Lees Profile: Jerry Lees

On occasion as a systems administrator you have to find the proverbial needle in the haystack with respect to the events in the event logs. You know what I mean, the one event you care about and need to know when it occured as part of your troubleshooting… then throw in that you need to do it in many servers. That’s a mess!

Sure, you can use event viewer and pull out some superadmin skills to filter the events to only see the ones you want– but your still only looking at one server at a time! Yes, you could export the events from multiple servers to a CSV file and then compile them into one excel spreadsheet– but that would take hours to do.

What if I told you there was a way to do it with VBScript? How much would you expect to pay? Three easy payments of 19.99?? … WAIT, don’t answer because it’s FREE!

The script below calls a function it defines called GetLogInfo to gather the requested event information to standard the standard output (the console). The function uses the Win32_NTLogEvent class from— you guessed it, our life long friend WMI! It accepts four inputs, in order; a string that is the name of the server, the Event ID that you are looking for, the specific application log you want to search, and the date in YYYYMMDD format. (Hint: if you have custom event logs on your server, or it is a DNS server or a Domain Controller, you can specify the name of the log instead of Application, System, or Security to get at the log information.)

Here is the script I wrote:

GetLogInfo “ServerName”,”1309″, “application”, “20081218”

Function GetLogInfo( StrComputer1, EventID, EventLogType, YYYYMMDD)

    Dim objWMIService, colItems, objItem
    Dim TempStr

    On Error Resume Next
    ‘ error control block
    Set objWMIService = GetObject(“winmgmts:{impersonationLevel=impersonate}//”_
    & strComputer1 & “\root\cimv2”)
    Set colItems = objWMIService.ExecQuery (“Select * from Win32_NTLogEvent Where EventCode=” &_
    EventID & ” and logfile='” & EventlogType & “‘”)
    For Each objItem in colItems
        TempStr = “”
        If mid(objItem.timegenerated,1,8) = YYYYMMDD Then
            TempStr = objItem.message
        End if
    On Error GoTo 0
End Function

 Comment on this Post

There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: