pars event log for event typer = error email event info script help

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

pars event log for event typer = error email event info script help

Logged in as: Guest

arrSession:exec spGetSession 2,2,58370

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> WSH & Client Side VBScript >> pars event log for event typer = error email event info script help
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1] 2 next > >>

Message

<< Older Topic Newer Topic >>

pars event log for event typer = error email event info... - 3/24/2008 1:42:54 PM

aron

Posts: 32
Score: 0
Joined: 10/31/2006
Status: offline

Hi All.
can anyone point me to the right direction to get a script running that will check the even logs via a scheduled task each morning so it will have to check the last 24hrs and look for any error type = Error then dump it to a text file so i can email it off.
here is something similar that i got off a site
the set number bit is what i cant seem to get correct or manipulate

this is what i tried but didnt work.

' EventLogFSO.vbs
' Sample VBScript to write event log data to text file
' Author Guy Thomas http://computerperformance.co.uk/
' Version 1.7 - May 2006
' -----------------------------------------------------------' 
Option Explicit

Dim objFSO, objFolder, objFile, objWMI, objItem, objShell
Dim strComputer, strFileName, strFileOpen, strFolder, strPath
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents
Dim intEventType, strLogType

' --------------------------------------------------------
' Set the folder and file name
strComputer = "."
strFileName = "\Event680.txt"
strFolder = "e:\logs"
strPath = strFolder & strFileName

' Set numbers
intNumberID = 680 ' Event ID Number
intEventType = 4
strLogType = "'Security'"
intRecordNum = 0

' -----------------------------------------------------
' Section to create folder and hold file.
' Create the File System Object
Set objFSO = CreateObject("Scripting.FileSystemObject")

' Check that the strFolder folder exists
If objFSO.FolderExists(strFolder) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFolder = objFSO.CreateFolder(strFolder)
WScript.Echo "Just created " & strFolder
End If

If objFSO.FileExists(strFolder & strFileName) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFile = objFSO.CreateTextFile(strFolder & strFileName)
Wscript.Echo "Just created " & strFolder & strFileName
End If 
' --------------------------------------------------
' Two tiny but vital commands (Try script without)
set objFile = nothing
set objFolder = nothing

' ----------------------------------------------------
' Write the information to the file
Wscript.Echo " Press OK and Wait 30 seconds (ish)"
Set strFileOpen = objFso.CreateTextFile(strPath, True)

' ----------------------------------------------------------
' WMI Core Section 
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile =" & strLogType)

' ----------------------------------------------------------
' Next section loops through ID properties

For Each objItem in colLoggedEvents
'If objItem.EventCode = intNumberID Then
If objItem.EventType = intEventType Then
strFileOpen.WriteLine("Category: " & objItem.Category _
& " string " & objItem.CategoryString) 
strFileOpen.WriteLine("ComputerName: " & objItem.ComputerName) 
strFileOpen.WriteLine("Logfile: " & objItem.Logfile _ 
& " source " & objItem.SourceName) 
strFileOpen.WriteLine("EventCode: " & objItem.EventCode) 
strFileOpen.WriteLine("EventType: " & objItem.EventType) 
strFileOpen.WriteLine("Type: " & objItem.Type) 
strFileOpen.WriteLine("User: " & objItem.User) 
strFileOpen.WriteLine("Message: " & objItem.Message)
strFileOpen.WriteLine (" ")
intRecordNum = intRecordNum +1
'End If 
End If
Next

' Confirms the script has completed and opens the file
Set objShell = CreateObject("WScript.Shell")
objShell.run ("Explorer" &" " & strPath & "\" )

WScript.Quit

' End of Guy's FSO sample VBScript

regards aron.

Post #: 1

RE: pars event log for event typer = error email event ... - 3/24/2008 3:40:48 PM

dm_4ever

Posts: 2641
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline

Filtering the returned event entries just requires you modifying the query.

In the example you posted it would be this line you need to modify: "Select * from Win32_NTLogEvent Where Logfile =" & strLogType

Add an "and" and then EventType='123' or whatever you're looking for...you can continue to filter in this manner.

Is this being executed on WinXP or better?

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to aron)

Post #: 2

RE: pars event log for event typer = error email event ... - 3/24/2008 4:17:47 PM

aron

Posts: 32
Score: 0
Joined: 10/31/2006
Status: offline

Thanks Dm_4ever

yes the OS are SBS, 2003 servers..

thanks for your help.

(in reply to dm_4ever)

Post #: 3

RE: pars event log for event typer = error email event ... - 3/24/2008 4:25:53 PM

aron

Posts: 32
Score: 0
Joined: 10/31/2006
Status: offline

hmm get an error

here is the lin with the error line 67 is the error

and here is the modified code that you asked me to change

and here is the full code ( for testing im running on xp pro)

' EventLogFSO.vbs
' Sample VBScript to write event log data to text file
' Author Guy Thomas [link=http://computerperformance.co.uk/]http://computerperformance.co.uk/[/link]
' Version 1.7 - May 2006
' -----------------------------------------------------------' 
Option Explicit
Dim objFSO, objFolder, objFile, objWMI, objItem, objShell
Dim strComputer, strFileName, strFileOpen, strFolder, strPath
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents
Dim intEventType, strLogType 
' --------------------------------------------------------
' Set the folder and file name
strComputer = "."
strFileName = "\Event680.txt"
strFolder = "c:\logs"
strPath = strFolder & strFileName
' Set numbers
'intNumberID = 680 ' Event ID Number
intEventType = "'Error'"
strLogType = "'Application'"
intRecordNum = 0
' -----------------------------------------------------
' Section to create folder and hold file.
' Create the File System Object
Set objFSO = CreateObject("Scripting.FileSystemObject")
' Check that the strFolder folder exists
If objFSO.FolderExists(strFolder) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFolder = objFSO.CreateFolder(strFolder)
WScript.Echo "Just created " & strFolder
End If
If objFSO.FileExists(strFolder & strFileName) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFile = objFSO.CreateTextFile(strFolder & strFileName)
Wscript.Echo "Just created " & strFolder & strFileName
End If 
' --------------------------------------------------
' Two tiny but vital commands (Try script without)
set objFile = nothing
set objFolder = nothing
' ----------------------------------------------------
' Write the information to the file
Wscript.Echo " Press OK and Wait 30 seconds (ish)"
Set strFileOpen = objFso.CreateTextFile(strPath, True)
' ----------------------------------------------------------
' WMI Core Section 
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile =" & strLogType &" and EventType =" & intEventType)
' ----------------------------------------------------------
' Next section loops through ID properties
For Each objItem in colLoggedEvents
'If objItem.EventCode = intNumberID Then
If objItem.EventType = intEventType Then
strFileOpen.WriteLine("Category: " & objItem.Category _
& " string " & objItem.CategoryString) 
strFileOpen.WriteLine("ComputerName: " & objItem.ComputerName) 
strFileOpen.WriteLine("Logfile: " & objItem.Logfile _ 
& " source " & objItem.SourceName) 
strFileOpen.WriteLine("EventCode: " & objItem.EventCode) 
strFileOpen.WriteLine("EventType: " & objItem.EventType) 
strFileOpen.WriteLine("Type: " & objItem.Type) 
strFileOpen.WriteLine("User: " & objItem.User) 
strFileOpen.WriteLine("Message: " & objItem.Message)
strFileOpen.WriteLine (" ")
intRecordNum = intRecordNum +1
'End If 
End If
Next
' Confirms the script has completed and opens the file
Set objShell = CreateObject("WScript.Shell")
objShell.run ("Explorer" &" " & strPath & "\" )
WScript.Quit
' End of Guy's FSO sample VBScript

appreciate your help..

(in reply to aron)

Post #: 4

RE: pars event log for event typer = error email event ... - 3/25/2008 12:17:34 AM

ebgreen

Posts: 4971
Score: 31
Joined: 7/12/2005
Status: offline

EventType is an int not a string.

_____________________________

"... when you are good and crazy, oooh, oooh, oooh, the sky is the limit!" - The Tick
Goog places to start:http://www.visualbasicscript.com/m_24727/tm.htm
http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to aron)

Post #: 5

RE: pars event log for event typer = error email event ... - 3/25/2008 12:31:23 AM

dm_4ever

Posts: 2641
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline

Looks like it is:
http://msdn2.microsoft.com/en-us/library/aa394226(VS.85).aspx

So an error is actually 1 if you look at the WMI class.

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to ebgreen)

Post #: 6

RE: pars event log for event typer = error email event ... - 3/26/2008 12:12:44 PM

aron

Posts: 32
Score: 0
Joined: 10/31/2006
Status: offline

oh cool thats working now thanks for that.

how do i go about only showing the last 24hrs from the time that the script runs..

so if i set it as a scheduled task to run at say 9am i wants to show the last 24 hours of logs from 9am..

cheers aron.

(in reply to dm_4ever)

Post #: 7

RE: pars event log for event typer = error email event ... - 3/26/2008 1:37:19 PM

TomRiddle

Posts: 188
Score: 4
Joined: 2/7/2008
Status: offline

That is exactly the same bit I am working on in my latest script. (An event log reading script like this one)
I am having problems with it because it only checks the date if the event passes through the query string.
Ideally being able to put the date in to the query string as a filter would solve my problem.

I will post my script when i have got it completely working

(in reply to aron)

Post #: 8

RE: pars event log for event typer = error email event ... - 3/26/2008 3:53:10 PM

dm_4ever

Posts: 2641
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline

The reason I asked if you were doing this on WinXP or better is because there is an easy way to convert standard date/time to UTC with WinXP or better

So for your script you would add to your query Where TimeGenerated >= UTCTime (which you can get with the function above)....I believe you have all the information you need to accomplish your task now.

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to TomRiddle)

Post #: 9

RE: pars event log for event typer = error email event ... - 3/26/2008 5:57:29 PM

TomRiddle

Posts: 188
Score: 4
Joined: 2/7/2008
Status: offline

I ended up getting mine working, the time check is still not in the actual query but it seems to work alright.

' Script by TomRiddle 2008 
' LockoutDetective.vbs 
' If a user is reporting repeated lockouts of their account, this script will identify the 
' workstation that is causing this. An account lockout can be caused by but not limited to,  
' a rouge user or a disused workstation left logged into after a subsequent password change. 
' This script will locate all your Domain Controllers and scan their security event logs. 
' Filtered output.csv file is created in same folder as script, which is to be interpreted in Excel. 
' Some variables can be modified in script setup section, User name and number of days 
' to search back are entered at script run time.

Option Explicit 
' Declare Variables 
  Dim objFSO, objWMI, objItem 
  Dim intNumberID, colLoggedEvents 
  Dim intEventType, strLogType 
  Dim strUser 
  Dim ParsedTime, ParsedUser, ParsedDomain, ParsedMessage, ParsedWorkstation 
  Dim DateFilter, objRootDSE, strConfig, adoCommand, adoConnection, adoRecordset 
  Dim strBase, strFilter, strAttributes, strQuery 
  Dim k, y, z, objDC, objDate 
' Script Setup 
  strUser = inputbox("Enter UserName to filter on", "Lockout Detective", "XXX") 
  DateFilter = inputbox("Enter number of days back you wish to check", "Lockout Detective", "1") 
  intNumberID = "'529'"          ' Event ID Number for login falure. 
  'intNumberID = "'539'"          ' Event ID Number for login lockout. 
  intEventType = 5 '5=failures 4=success 
  strLogType = "'Security'" 
' Write output log file header 
  Set objFSO = CreateObject("Scripting.FileSystemObject") 
  WriteLogFile "Controller,Time,User,Domain,Computer,Message" 
' Determine configuration context and DNS domain from RootDSE object. 
  Set objRootDSE = GetObject("[link=http://www.visualbasicscript.com/ldap://RootDSE]LDAP://RootDSE[/link]") 
  strConfig = objRootDSE.Get("configurationNamingContext") 
' Identify all Domain Controllers. 
  Set adoCommand = CreateObject("ADODB.Command") 
  Set adoConnection = CreateObject("ADODB.Connection") 
  adoConnection.Provider = "ADsDSOObject" 
  adoConnection.Open "Active Directory Provider" 
  adoCommand.ActiveConnection = adoConnection 
  strBase = "<LDAP://" & strConfig & ">" 
  strFilter = "(objectClass=nTDSDSA)" 
  strAttributes = "AdsPath" 
  strQuery = strBase & ";" & strFilter & ";" & strAttributes & ";subtree" 
  adoCommand.CommandText = strQuery 
  adoCommand.Properties("Page Size") = 100 
  adoCommand.Properties("Timeout") = 60 
  adoCommand.Properties("Cache Results") = False 
  Set adoRecordset = adoCommand.Execute 
' Save Domain Controller AdsPaths into dynamic array arrstrDCs. 
  k=0 
  Do Until adoRecordset.EOF 
     Set objDC = _ 
     GetObject(GetObject(adoRecordset.Fields("AdsPath").Value).Parent) 
     ReDim Preserve arrstrDCs(k) 
     arrstrDCs(k) = objDC.DNSHostName 
     k=k+1 
     adoRecordset.MoveNext 
  Loop 
  adoRecordset.Close 
' Feed EACH Domain Controller name to event log reader 
  For k = 0 To Ubound(arrstrDCs) 
     if instr(arrstrDCs(k), "ROOT") = 0 then 
        msgbox arrstrDCs(k)
        EvLFilter arrstrDCs(k), strLogType, intEventType, intNumberID 
     end if 
  Next 
 msgbox "Done" 
'----------------------------------------------------------- 
sub EvLFilter(DC, strLogType, intEventType, intNumberID) 
' Loop Through Filtered Event Logs 
  Set objWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & DC & "\root\cimv2") 
  Set colLoggedEvents = objWMI.ExecQuery ("Select * from Win32_NTLogEvent Where Logfile =" & strLogType & " and EventCode = " &intNumberID) 
  For Each objItem in colLoggedEvents 
     If objItem.EventType = intEventType then 
        ParseTime objItem.TimeGenerated 
        if now-DateFilter > ParsedTime then        
           'msgbox "Read back "& DateFilter & " Days" 
           exit sub 
        end if 
        ParseUser(objItem.Message) 
        if ucase(ParsedUser) <> ucase(strUser) and strUser <> "" then 
           'skip to next event log item 
        else 
           ParseWorkstation(objItem.Message) 
           ParseDomain(objItem.Message) 
           ParseMessage(objItem.Message) 
           WriteLogFile DC&","&ParsedTime&","&ParsedUser&","&ParsedDomain&","&ParsedWorkstation&","&ParsedMessage 
        end if 
     End If 
  Next 
end sub 
'----------------------------------------------------------- 
sub ParseWorkstation(xxx) 
' Extract workstation name from event log 
  xxx=replace(xxx, vbtab, "") 
  z=instr(xxx, "Workstation Name:") : y=len(xxx) 
  xxx=right(xxx, y-z-16) 
  z=instr(xxx, vbcrlf) 
  ParsedWorkstation=left(xxx, z-1) 
end sub 
'----------------------------------------------------------- 
sub ParseUser(xxx) 
' Extract user name from event log 
  xxx=replace(xxx, vbtab, "") 
  z=instr(xxx, "User Name:") : y=len(xxx) 
  xxx=right(xxx, y-z-9) 
  z=instr(xxx, vbcrlf) 
  ParsedUser=left(xxx, z-1) 
end sub 
'----------------------------------------------------------- 
sub ParseDomain(xxx) 
' Extract Domain name from event log 
  xxx=replace(xxx, vbtab, "") 
  z=instr(xxx, "Domain:") : y=len(xxx) 
  xxx=right(xxx, y-z-6) 
  z=instr(xxx, vbcrlf) 
  ParsedDomain=left(xxx, z-1) 
end sub 
'----------------------------------------------------------- 
sub ParseMessage(xxx) 
' Extract Reason Message from event log 
  xxx=replace(xxx, vbtab, "") 
  z=instr(xxx, "Reason:") : y=len(xxx) 
  xxx=right(xxx, y-z-6) 
  z=instr(xxx, vbcrlf) 
  ParsedMessage=left(xxx, z-1) 
end sub 
'----------------------------------------------------------- 
sub ParseTime(xxx) 
' Convert WMI time to Australian format time (day, month, year) 
  ParsedTime =  CDate(Mid(xxx, 7, 2) & "/" & _ 
     Mid(xxx, 5, 2) & "/" & Left(xxx, 4) _ 
         & " " & Mid (xxx, 9, 2) & ":" & _ 
             Mid(xxx, 11, 2) & ":" & Mid(xxx,13, 2)) 
end sub 
'----------------------------------------------------------- 
Sub WriteLogFile(Content) 
' Write the filtered results to a csv file for close examination 
  objFSO.OpenTextFile("output.csv", 8, True).WriteLine Content 
End Sub 
'----------------------------------------------------------- 
' Clean up. 
  adoConnection.Close 
  Set objRootDSE = Nothing 
  Set adoConnection = Nothing 
  Set adoCommand = Nothing 
  Set adoRecordset = Nothing 
  Set objDC = Nothing 
  set objFSO = Nothing

< Message edited by TomRiddle -- 3/26/2008 8:55:46 PM >

(in reply to dm_4ever)

Post #: 10

RE: pars event log for event typer = error email event ... - 3/26/2008 9:00:45 PM

TomRiddle

Posts: 188
Score: 4
Joined: 2/7/2008
Status: offline

Thanks for that UTC date conversion script dm, it will be handy to know how to convert that way.

(in reply to dm_4ever)

Post #: 11

RE: pars event log for event typer = error email event ... - 3/27/2008 4:49:37 AM

dm_4ever

Posts: 2641
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline

Example:

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to TomRiddle)

Post #: 12

RE: pars event log for event typer = error email event ... - 3/28/2008 2:32:52 PM

TomRiddle

Posts: 188
Score: 4
Joined: 2/7/2008
Status: offline

Thanks dm,
I will use that, though convert the date outside the main sub in the interests of script efficiency because my script may want to search back many days over thousands of event log entries.

Option Explicit

main StdToUTCTime(Now()- 1)

Sub Main(UTCTime)
   Dim objWMIService : Set objWMIService = GetObject("winmgmts:{(Security)}\\.\root\cimv2")
   Dim colEvents : Set colEvents = objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent " & _
                                                           "WHERE LogFile='Security' AND TimeGenerated >= '" & _
                                                           UTCTime & "'",, 48)
   Dim objEvent
   For Each objEvent In colEvents
       WScript.Echo "Event Code:  " & objEvent.EventCode & VbCrLf & _
                    "Time Generated:  " & objEvent.TimeGenerated & VbCrLf & _
                    "Category:  " & objEvent.Category & VbCrLf & _
                    "Message:  " & objEvent.Message & VbCrLf & String(40, "=")
   Next
End Sub

Function StdToUTCTime(inputDT)
  Dim objTime : Set objTime = CreateObject("WbemScripting.SWbemDateTime")
  Dim UTCDateTime: UTCDateTime = objtime.SetVarDate(inputDT)
  StdToUTCTime = objTime
End Function

EDIT:
Link to the final version of my script - uses dm_4ever's StdToUTCTime function and query syntax to save me looping through unnecessary logs.
http://www.visualbasicscript.com/fb.aspx?m=58499

< Message edited by TomRiddle -- 3/28/2008 9:29:58 PM >

(in reply to dm_4ever)

Post #: 13

RE: pars event log for event typer = error email event ... - 3/30/2008 5:18:10 PM

aron

Posts: 32
Score: 0
Joined: 10/31/2006
Status: offline

sorry for the late reply

im gettng an error

line 74 ( thats the select statement line)
Wrong number of arguments or invalid property assignemnt: 'StdToUTCTime''

here is the select statment

an the full code

' -----------------------------------------------------
' time function
WScript.Echo StdToUTCTime(Now() - 1)
Function StdToUTCTime(inputDT)
  Dim objTime : Set objTime = CreateObject("WbemScripting.SWbemDateTime")
  Dim UTCDateTime: UTCDateTime = objtime.SetVarDate(inputDT)
  StdToUTCTime = objTime
End Function

' -----------------------------------------------------
' Section to create folder and hold file.
' Create the File System Object
Set objFSO = CreateObject("Scripting.FileSystemObject")
' Check that the strFolder folder exists
If objFSO.FolderExists(strFolder) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFolder = objFSO.CreateFolder(strFolder)
WScript.Echo "Just created " & strFolder
End If
If objFSO.FileExists(strFolder & strFileName) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFile = objFSO.CreateTextFile(strFolder & strFileName)
Wscript.Echo "Just created " & strFolder & strFileName
End If 
' --------------------------------------------------
' Two tiny but vital commands (Try script without)
set objFile = nothing
set objFolder = nothing
' ----------------------------------------------------
' Write the information to the file
Wscript.Echo " Press OK and Wait 30 seconds (ish)"
Set strFileOpen = objFso.CreateTextFile(strPath, True)
' ----------------------------------------------------------
' WMI Core Section 
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile =" & strLogType & " and EventType =" & intEventType & " and TimeGenerated >= " & StdToUTCTime )
' ----------------------------------------------------------
' Next section loops through ID properties
For Each objItem in colLoggedEvents
'If objItem.EventCode = intNumberID Then
If objItem.EventType = intEventType Then
strFileOpen.WriteLine("Category: " & objItem.Category _
& " string " & objItem.CategoryString) 
strFileOpen.WriteLine("ComputerName: " & objItem.ComputerName) 
strFileOpen.WriteLine("Logfile: " & objItem.Logfile _ 
& " source " & objItem.SourceName) 
strFileOpen.WriteLine("EventCode: " & objItem.EventCode) 
strFileOpen.WriteLine("EventType: " & objItem.EventType) 
strFileOpen.WriteLine("Type: " & objItem.Type) 
strFileOpen.WriteLine("User: " & objItem.User) 
strFileOpen.WriteLine("Message: " & objItem.Message)
strFileOpen.WriteLine (" ")
intRecordNum = intRecordNum +1
'End If 
End If
Next
' Confirms the script has completed and opens the file
Set objShell = CreateObject("WScript.Shell")
objShell.run ("Explorer" &" " & strPath & "\" )
WScript.Quit
' End of Guy's FSO sample VBScript

appreciate your help ... aron.

(in reply to TomRiddle)

Post #: 14

RE: pars event log for event typer = error email event ... - 3/30/2008 9:34:48 PM

TomRiddle

Posts: 188
Score: 4
Joined: 2/7/2008
Status: offline

StdToUTCTime is a function and you are not passing anything to it in that line

Edit Note, dm_forever and I posted two different examples.

< Message edited by TomRiddle -- 3/30/2008 9:37:42 PM >

(in reply to aron)

Post #: 15

RE: pars event log for event typer = error email event ... - 4/1/2008 11:08:01 AM

aron

Posts: 32
Score: 0
Joined: 10/31/2006
Status: offline

oh ok.

i think iv done it correctly now, but get another error to with the part of the script that writes the file.

here is the function



here is the select statment



and this is where the script errors althoe dosent give me what its falling over on just says error at line 80..

this is line 80



this is the entire part that spits out the file.



and full code

' -----------------------------------------------------
' Section to create folder and hold file.
' Create the File System Object
Set objFSO = CreateObject("Scripting.FileSystemObject")
' Check that the strFolder folder exists
If objFSO.FolderExists(strFolder) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFolder = objFSO.CreateFolder(strFolder)
WScript.Echo "Just created " & strFolder
End If
If objFSO.FileExists(strFolder & strFileName) Then
Set objFolder = objFSO.GetFolder(strFolder)
Else
Set objFile = objFSO.CreateTextFile(strFolder & strFileName)
Wscript.Echo "Just created " & strFolder & strFileName
End If 
' --------------------------------------------------
' Two tiny but vital commands (Try script without)
set objFile = nothing
set objFolder = nothing
' ----------------------------------------------------
' Write the information to the file
Wscript.Echo " Press OK and Wait 30 seconds (ish)"
Set strFileOpen = objFso.CreateTextFile(strPath, True)
' ----------------------------------------------------------
' WMI Core Section 
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile =" & strLogType & " and EventType =" & intEventType & " and TimeGenerated >= " & UTCTime )
' ----------------------------------------------------------
' Next section loops through ID properties
For Each objItem in colLoggedEvents
'If objItem.EventCode = intNumberID Then
If objItem.EventType = intEventType Then
strFileOpen.WriteLine("Category: " & objItem.Category _
& " string " & objItem.CategoryString) 
strFileOpen.WriteLine("ComputerName: " & objItem.ComputerName) 
strFileOpen.WriteLine("Logfile: " & objItem.Logfile _ 
& " source " & objItem.SourceName) 
strFileOpen.WriteLine("EventCode: " & objItem.EventCode) 
strFileOpen.WriteLine("EventType: " & objItem.EventType) 
strFileOpen.WriteLine("Type: " & objItem.Type) 
strFileOpen.WriteLine("User: " & objItem.User) 
strFileOpen.WriteLine("Message: " & objItem.Message)
strFileOpen.WriteLine (" ")
intRecordNum = intRecordNum +1
'End If 
End If
Next
' Confirms the script has completed and opens the file
Set objShell = CreateObject("WScript.Shell")
objShell.run ("Explorer" &" " & strPath & "\" )
WScript.Quit
' End of Guy's FSO sample VBScript

cheers aron

(in reply to TomRiddle)

Post #: 16

RE: pars event log for event typer = error email event ... - 4/2/2008 12:17:55 AM

ebgreen

Posts: 4971
Score: 31
Joined: 7/12/2005
Status: offline

Are you certain that anything is being returned by the query?

_____________________________

"... when you are good and crazy, oooh, oooh, oooh, the sky is the limit!" - The Tick
Goog places to start:http://www.visualbasicscript.com/m_24727/tm.htm
http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to aron)

Post #: 17

RE: pars event log for event typer = error email event ... - 4/2/2008 3:42:44 PM

aron

Posts: 32
Score: 0
Joined: 10/31/2006
Status: offline

the script appears to run to the point where it creates the file then hangs on inserting the data into the file. but i don't get a error as in it dosen't tell me whats wrong, just says error and give a line reference.

cheers aron.

(in reply to ebgreen)

Post #: 18

RE: pars event log for event typer = error email event ... - 4/3/2008 12:23:45 AM

ebgreen

Posts: 4971
Score: 31
Joined: 7/12/2005
Status: offline

Ok, there are some issues here around the file creation. I don't know that they are causing your problem, bu