#124650 - 2004-08-09 01:51 PM
WMI Winmgmts searching Win32_NTLogEvent by date and time
|
Scrib
Fresh Scripter
Registered: 2002-07-08
Posts: 13
Loc: uk
|
Why doesnt this work?
If I do a query on the NT eventlog using WMI on the date only it works fine. If I then want to reduce the search results by adding in the time to the search query is doesn't work.
Note: I've tried it without subtracting 1 from $the_hour and just changing the system time to one hour ago and it still doesnt work.
I am wondering if its down to the varibles only holding a limited number size?
Code as follows:
Break on
Generate_simple_date_varibles ()
$the_hour = Val($the_hour)
If $the_hour > 1
$the_hour = $the_hour - 1
EndIf
$Eventvwr_Date = $the_year + $the_month + $the_day + $the_hour + $the_minute + $the_second
;$Eventvwr_Date = $the_year + $the_month + $the_day ; This works with no time - why?
?"Search date time: $Eventvwr_Date"?
$EventLog_count_All = 0
$Eventvwr_log = Application
$Eventvwr_Type = information
$events = GetObject("Winmgmts:\\@WKSTA").ExecQuery("Select * from Win32_NTLogEvent Where Type = '$Eventvwr_Type' AND Logfile = '$Eventvwr_log' AND TimeWritten >= '$Eventvwr_Date' ")
For Each $event In $events
?"Orig EVT date time: " + $event.TimeWritten
$EventLog_count_All = $EventLog_count_All + 1
Next
??"Count is $EventLog_count_All"
?"press any key"
Get $dummy
Exit
Function Generate_simple_date_varibles ()
$the_date_unstripped = @DATE
$the_time_unstripped = @TIME
$the_year = SubStr($the_date_unstripped,1,4)
$the_month = SubStr($the_date_unstripped,6,2)
$the_day = SubStr($the_date_unstripped,9,2)
$the_hour = SubStr($the_time_unstripped,1,2)
$the_minute = SubStr($the_time_unstripped,4,2)
$the_second = SubStr($the_time_unstripped,7,2)
EndFunction
|
|
Top
|
|
|
|
|
#124651 - 2004-08-09 02:35 PM
Re: WMI Winmgmts searching Win32_NTLogEvent by date and time
|
Kdyer
KiX Supporter
Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
|
Why aren't you using DATECALC()/SERIALDATE() UDF(s)?
They will make your life easier. 
Kent
|
|
Top
|
|
|
|
|
#124652 - 2004-08-10 01:26 PM
Re: WMI Winmgmts searching Win32_NTLogEvent by date and time
|
Scrib
Fresh Scripter
Registered: 2002-07-08
Posts: 13
Loc: uk
|
Thanks for your help.
I've had a look the the UDFs you mentioned and others, but I don't understand how these will help. The format for this WMI query must be yyyymmddhhmmss with no colons.
It works fine running the query using yyyymmdd but fails when adding the time.
I've now tried the same thing using CDbl, stings, etc with no avail.
Any ideas?
|
|
Top
|
|
|
|
|
#124653 - 2004-08-10 02:09 PM
Re: WMI Winmgmts searching Win32_NTLogEvent by date and time
|
Richard H.
Administrator
Registered: 2000-01-24
Posts: 4946
Loc: Leatherhead, Surrey, UK
|
You have to include the entire timestamp, including the milliseconds and the offset from GMT (UTC).
Here is an example.
Note, I have hard-coded the offset as "+0", and simply subtracting "1" from the hour is a bit less than smart, but I'll leave you to sort those out 
Code:
$=SetOption("Explicit","ON")
$=SetOption("WrapAtEOL","ON")
$=SetOption("ASCII","ON")
Dim $sEvtLog,$sEvtType,$sEvtTimestamp
Dim $oEvents,$oEvent
Dim $asNow
$sEvtLog = "System"
$sEvtType = "Information"
$asNow=Split(@TIME,":")
$sEvtTimestamp=CStr(Join(Split(@DATE,"/"),""))
+CStr(Right("0"+(Cint($asNow[0])-1),2))
+$asNow[1]
+$asNow[2]
+".000000"
+"+0" ; OFFSET FROM GMT (in minutes)
$sEvtTimeStamp ?
$oEvents = GetObject("Winmgmts:\\@WKSTA").ExecQuery("
Select * from Win32_NTLogEvent
Where
Type = '"+$sEvtType+"'
AND Logfile = '"+$sEvtLog+"'
AND TimeWritten >= '"+$sEvtTimestamp+"'
")
For Each $oEvent In $oEvents
"Orig EVT date time: " + $oEvent.TimeWritten ?
Next
Exit 0
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 1471 anonymous users online.
|
|
|
