Windows Server - Event log check

Asked By Georg

10-Apr-07 06:28 AM

Hi ,

I am running a script to find the event log errors for a group of servers.

--------------------
Const ForReading = 1
Const ForAppending = 8
Const CONVERT_TO_LOCAL_TIME = True


Set objFSO = CreateObject("Scripting.FileSystemObject")
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
DateToCheck = CDate("4/3/2007")
dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
dtmEndDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME

Set objTextFile = objFSO.OpenTextFile _
("C:\servers.txt", ForReading)

Set objTextFile1 = objFSO.OpenTextFile _
("C:\service_status.txt", ForAppending, True)


Set objTextFile2 = objFSO.OpenTextFile _
("C:\log_status.txt", ForAppending, True)

Do Until objTextFile.AtEndOfStream
strNextLine = objTextFile.Readline
arrServiceList = Split(strNextLine , ",")


strComputer = arrServiceList(0)

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")



Set colRunningServices = objWMIService.ExecQuery("Select * from
Win32_Service")

For Each objService in colRunningServices
if  objService.StartMode = "Auto" then
if objService.State= "Stopped" then
objTextFile1.WriteLine arrServiceList(0) &vbtab & objService.DisplayName  &
VbTab & objService.State
End if
End if
Next
Set colEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where TimeWritten >= '"  & dtmStartDate
& "' and TimeWritten < '" & dtmEndDate & "'")


For Each objEvent in colEvents

if  objEvent.Type = "error"  then
objTextfile2.WriteLine  "Computer Name: " & arrServiceList(0) _
& vbtab & objEvent.SourceName _
& vbtab & objEvent.TimeWritten _
& vbtab & objEvent.Type _
& vbtab & objEvent.User
End if
Next


Loop
----------------------------
The problem is this script checks the logs only for the day 4/3/2007.

I want to find the log error for period of time. For example: The time now
to last 7 days. ie. 4/3/2007 to 4/10/2007..

Please help me in this.

Regards,
George.

10-Apr-07 07:12 AM

To query from 4/3/2007 to 4/10/2007 you should use:

DateToCheck = CDate("4/3/2007")
dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
dtmEndDate.SetVarDate DateToCheck +7, CONVERT_TO_LOCAL_TIME

Or, to make the code more generic, I would suggest:

DateToCheck = Now()
dtmStartDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME
dtmEndDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

10-Apr-07 09:16 AM

Hi Richard,

I had changed start and end date. But still it is returning the 'error'
events for the day 3/4/2007

The query passing is

Select * from Win32_NTLogEvent Where TimeWritten >=
'20070403091237.000000-240' and TimeWritten < '20070410091237.000000-240'

Please help me in this.

Regards,
George.

10-Apr-07 01:48 PM

The query works for me and returns 7 days of events from April 3 through
April 10. The UTC format for dates is independent of the locale setting, so
I don't see how you can get events for March with the query you show. The
UTC format is:

YYYYMMDDhhmmss.xxxxxx-zzz

where YYYY is the four digit year, MM the month, DD the day, hh the hours
(24 hour clock), mm the minutes, ss the seconds, xxxxxx the milliseconds,
and zzz the time zone offset.

One thought. You test for event type "error", but I believe it is "Error".
You might want to use LCase to make the check case insensitive:

If (LCase(objEvent.Type) = "error") Then

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

11-Apr-07 08:04 AM

Thanks Richard. The event type 'Error' is case sensitive. Now it returns the
events error for the last 7 days. Thanks for your help.

Regards,
George.