[Solved] EventLog query: source null

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

[Solved] EventLog query: source null

Logged in as: Guest

arrSession:exec spGetSession 2,2,50930

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> WSH & Client Side VBScript >> [Solved] EventLog query: source null
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

[Solved] EventLog query: source null - 8/18/2007 7:22:19 AM

sheepz

Posts: 247
Score: 2
Joined: 3/17/2006
From: Riverside the 909s
Status: offline

for testing purposes i'm querying an eventID 777, which does not exist in any of Application, Security, System LogFiles.

Query System LogFile, with eventID = 777... successful

strComputer = "."
iNumID = 777 'Event ID Number
EventFile = "System" 'LogFile
Set objWMI = GetObject("winmgmts:" _ 
& "{impersonationLevel=impersonate}!\\" _ 
& strComputer & "\root\cimv2") 
'Query EventLog
Set colLoggedEvents = objWMI.ExecQuery _ 
("SELECT * FROM Win32_NTLogEvent WHERE Logfile = " _
& "'" & EventFile & "'" & " AND EventCode = " & "'" & iNumID & "'")

'Loop thru Event properties 
intEvent = 1 
For Each objEvent in colLoggedEvents
EventNumber = intEvent
EventCategory = objEvent.Category 'Subcategory for this event. This subcategory is source-specific. 
EventCategoryString = objEvent.Category 'Translation of the subcategory. The translation is source-specific. 
EventCompName = objEvent.ComputerName 
EventCode = objEvent.EventCode 'Actual EVENT CODE 
EventMsg = objEvent.Message
EventRecordNum = objEvent.RecordNumber 'Identifies the event within the Windows NT event log file. This is specific to the log file and is used together with the log file name to uniquely identify an instance of this class. 
EventSourceName = objEvent.SourceName 
EventTimeGenerated = WMIDateStringToDate(objEvent.TimeGenerated) 'The source that generated the event. 
EventTimeWritten = WMIDateStringToDate(objEvent.TimeWritten) 'Event was written to the log file. 
EventType = objEvent.Type 'Type = Warning/Error/Information 
EventUser = objEvent.User 
MsgBox EventCode & vbLf & _
       EventMsg & vbLf & _
       EventTimeGenerated & vbLf & _
       EventType & vbLf & _ 
       EventUser
       
'increment EventNumber    
IntEvent = intEvent + 1 
Next
MsgBox "EOF"

this seems to work, even though it does not find any eventID 777 i get my msg EOF

but when i try the same thing but change the LogFile to Application. i get an error Source: (null)

strComputer = "."
iNumID = 777 'Event ID Number
EventFile = "Application" 'LogFile
Set objWMI = GetObject("winmgmts:" _ 
& "{impersonationLevel=impersonate}!\\" _ 
& strComputer & "\root\cimv2") 
'Query EventLog
Set colLoggedEvents = objWMI.ExecQuery _ 
("SELECT * FROM Win32_NTLogEvent WHERE Logfile = " _
& "'" & EventFile & "'" & " AND EventCode = " & "'" & iNumID & "'")
'Loop thru Event properties 
intEvent = 1 
For Each objEvent in colLoggedEvents
EventNumber = intEvent
EventCategory = objEvent.Category 'Subcategory for this event. This subcategory is source-specific. 
EventCategoryString = objEvent.Category 'Translation of the subcategory. The translation is source-specific. 
EventCompName = objEvent.ComputerName 
EventCode = objEvent.EventCode 'Actual EVENT CODE 
EventMsg = objEvent.Message
EventRecordNum = objEvent.RecordNumber 'Identifies the event within the Windows NT event log file. This is specific to the log file and is used together with the log file name to uniquely identify an instance of this class. 
EventSourceName = objEvent.SourceName 
EventTimeGenerated = WMIDateStringToDate(objEvent.TimeGenerated) 'The source that generated the event. 
EventTimeWritten = WMIDateStringToDate(objEvent.TimeWritten) 'Event was written to the log file. 
EventType = objEvent.Type 'Type = Warning/Error/Information 
EventUser = objEvent.User 
MsgBox EventCode & vbLf & _
       EventMsg & vbLf & _
       EventTimeGenerated & vbLf & _
       EventType & vbLf & _ 
       EventUser
       
'increment EventNumber    
IntEvent = intEvent + 1 
Next
MsgBox "EOF"

the only thing changed was the LogFile, i get an error number 0x90041001   Source: (Null)  on line 19 which is:
For Each objEvent in colLoggedEvents

1. why does it only error out for Application LogFile and not the System LogFile?

2. Is there any way to check if the colLoggedEvents if it's null? maybe something like:
     If IsNull(colLoggedEvents) Then
    MsgBox "No items found"
End If

I tried this but nothing happens

i looke up the error number 80041001, found nothing that could help
http://support.microsoft.com/kb/924935
http://www.computerperformance.co.uk/Logon/code/code_80041001.htm

< Message edited by sheepz -- 8/23/2007 2:08:24 PM >

Post #: 1

RE: EventLog query: source null - 8/18/2007 7:33:43 AM

dm_4ever

Posts: 2663
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline

That's interesting...it works fine for me whether I specify "System" or "Application" log file. I'll see if I can duplicate the error.

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to sheepz)

Post #: 2

RE: EventLog query: source null - 8/18/2007 8:14:53 AM

CondoPC

Posts: 118
Score: 0
Joined: 7/23/2007
Status: offline

>>2. Is there any way to check if the colLoggedEvents if it's null? maybe something like:
     If IsNull(colLoggedEvents) Then
    MsgBox "No items found"
End If

I posted a similar issue last night when using a filtering query with QueryExec. As for your #2, you may want to try and qualify the results by using a count.

if colLoggedEvents.count < 1 then
wscript.echo "no matching events found"
else
wscript.echo "matches found"
For <...more code here ...>
End If

(in reply to sheepz)

Post #: 3

RE: EventLog query: source null - 8/18/2007 9:10:12 AM

sheepz

Posts: 247
Score: 2
Joined: 3/17/2006
From: Riverside the 909s
Status: offline

dm - thanks for verifying, i haven't checked this on another pc. since you guys didn't see anything wrong i'll try on another PC
Condo - i saw your post right after i posted mine. =) thx for the colLoggedEvents.count, i didn't know the properties of collections. is .count the only one? trying to see if theres any other properties.

found this site... seems theres two properties to collectsion .count and .item, and one method .Refresh
http://www.devguru.com/technologies/ado/quickref/parameter_propertiescollection.html

< Message edited by sheepz -- 8/18/2007 9:16:38 AM >

(in reply to CondoPC)

Post #: 4

RE: EventLog query: source null - 8/18/2007 9:22:01 AM

sheepz

Posts: 247
Score: 2
Joined: 3/17/2006
From: Riverside the 909s
Status: offline

i used this:

if colLoggedEvents.count < 1 then
wscript.echo "no matching events found"
else
wscript.echo "matches found"
End If

And tried:

If colLoggedEvents.count = 0 Then
wscript.echo "no matching events found"
else
wscript.echo "matches found"
End If

and both still get an
Error: Generic failure
Source: SWbemObjectSet

< Message edited by sheepz -- 8/18/2007 9:48:44 AM >

(in reply to sheepz)

Post #: 5

RE: EventLog query: source null - 8/18/2007 10:00:42 AM

sheepz

Posts: 247
Score: 2
Joined: 3/17/2006
From: Riverside the 909s
Status: offline

sorry about that DM and condo, i used:

if colLoggedEvents.count < 1 then
wscript.echo "no matching events found"
else
wscript.echo "matches found"
End If

and i get that generic failure on one desktop... i tried the same script on another desktop and it works fine... seems apparent that something is wrong with the other desktop... i was getting confused why System Logfile would work and Application wouldn't...

thanks helping