EventLog Object strange numeric comparation

Author Message
nakra

  • Total Posts : 10
  • Scores: 0
  • Reward points : 0
  • Joined: 3/16/2011
  • Status: offline
EventLog Object strange numeric comparation Tuesday, January 10, 2012 8:15 AM (permalink)
0
Hello
I have to test the size of some event logs (Application, Security and System) on a Windows XP machine. In order to do this, I've done a simple script to iterate over the logs and compared each log size with a predefined value.
The problem is that that a logic condition is evaluated strangely, always evaluating TRUE.. can anybody help me understand why?
 
This is the script:
 Const iAppMax = 2000000
Const iSecMax = 1000000
Const iSysMax = 100000

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
 & strComputer & "\root\cimv2")
 
Set colLogFiles = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_NTEventLogFile")
 
For Each objLogFile in colLogFiles
 iLogMax = 0
 Select Case objLogFile.LogFileName
 Case "Application"
 iLogMax = iAppMax
 Case "Security"
 iLogMax = iSecMax
 Case "System"
 iLogMax = iSysMax
 End Select
 If iLogMax > 0 And objLogFile.FileSize > iLogMax Then
 WScript.Echo objLogFile.LogFileName & " is too big! Size = [" & objLogFile.FileSize & "]"
 End If
Next 

 
On my system, the Application log is ~192KB, Security log is ~64 KB and System log is ~512 KB, making the output of the script to be:
 
 Application is too big! Size = [196608]
Security is too big! Size = [65536]
System is too big! Size = [524288] 

 
The problem is the second member of the If condition: oLogFile.FileSize > iLogMax which always evaluates TRUE (196608 > 2000000, 65536 > 1000000, 524288 > 100000), but it should be true just for the last one (System log, which is indeed bigger then 100000 bits).
Replacing the iLogMax variable with a plain numeric value, makes the script to run as supposed.
Why does this strange behavior occur?
 
Thanks
 
 
 
#1
    ebgreen

    • Total Posts : 8227
    • Scores: 98
    • Reward points : 0
    • Joined: 7/12/2005
    • Status: online
    Re:EventLog Object strange numeric comparation Tuesday, January 10, 2012 8:26 AM (permalink)
    0
    use CLng(objLogFile.fileSize)
    "... when you are good and crazy, oooh, oooh, oooh, the sky is the limit!" - The Tick
    Goog places to start:http://www.visualbasicscript.com/m_24727/tm.htm
    http://www.visualbasicscript.com/m_47117/tm.htm
     
    #2
      nakra

      • Total Posts : 10
      • Scores: 0
      • Reward points : 0
      • Joined: 3/16/2011
      • Status: offline
      Re:EventLog Object strange numeric comparation Wednesday, January 11, 2012 6:49 AM (permalink)
      0
      It works, thanks!
      But I don't understand why do I need that conversion since according to msdn description of Win32_NTEventlogFile class, the FileSize property returns uint64.
       
      #3
        ebgreen

        • Total Posts : 8227
        • Scores: 98
        • Reward points : 0
        • Joined: 7/12/2005
        • Status: online
        Re:EventLog Object strange numeric comparation Wednesday, January 11, 2012 6:51 AM (permalink)
        0
        to be honest, I'm not sure.
        "... when you are good and crazy, oooh, oooh, oooh, the sky is the limit!" - The Tick
        Goog places to start:http://www.visualbasicscript.com/m_24727/tm.htm
        http://www.visualbasicscript.com/m_47117/tm.htm
         
        #4
          59cobalt

          • Total Posts : 969
          • Scores: 91
          • Reward points : 0
          • Joined: 7/17/2011
          • Status: offline
          Re:EventLog Object strange numeric comparation Wednesday, January 11, 2012 9:01 AM (permalink)
          0
          It's because .FileSize actually returns the values as strings, so he's doing a string comparison instead of comparing numeric values.
           
          #5

            Online Bookmarks Sharing: Share/Bookmark

            Jump to:

            Current active users

            There are 0 members and 1 guests.

            Icon Legend and Permission

            • New Messages
            • No New Messages
            • Hot Topic w/ New Messages
            • Hot Topic w/o New Messages
            • Locked w/ New Messages
            • Locked w/o New Messages
            • Read Message
            • Post New Thread
            • Reply to message
            • Post New Poll
            • Submit Vote
            • Post reward post
            • Delete my own posts
            • Delete my own threads
            • Rate post

            2000-2012 ASPPlayground.NET Forum Version 3.9