This is kind of crude, but this method finds how many days back you have to go to get at LEAST 5 events and cuts it off on that day... (It's also pretty slow.) The more I read about it, the more I realize that you can actually create a "Trigger" of sorts when an event occurs that will allow you to send email or whatever.

Here is the (kludgy) code I wrote:

code:
break on
$day1 = "@MDAYNO"
$month1 = "@MONTHNO"
$year1 = "@YEAR"
If LEN($day1) = 1 $day1 = "0" + $day1 Endif
If LEN($month1) = 1 $month1 = "0" + $month1 Endif
$time1 =  $year1 + $month1 + $day1
$count = 0
While $instancetarget < 5
$count = $count + 1
 $ntbackup =GetObject("winmgmts:").ExecQuery("Select * From Win32_NTLogEvent Where SourceName = 'ntbackup' AND TimeGenerated >= '" + $time1 + "'")
 $instancetarget = $ntbackup.count
$time1 =  VAl($time1) - 1
if $count > 200 $instancetarget = 5
Loop

  For each $event in $ntbackup
    $ec=$event.EventIdentifier
    $time=$event.TimeGenerated
    $year=substr("$time",1,4)
    $month=substr("$time",5,2)
    $day=substr("$time",7,2)
? $time
    ? "$month/$day/$year"
    ? $event.Message
    Next
Brian