Photo Gallery Member List Search Calendars FAQ Ticket List Log Out


Query for string INSIDE Windows Event Log

  		Logged in as: Guest
arrSession:exec spGetSession 2,2,59736
Active Users: There are 0 members and 0 guests.
Users viewing this topic: none
 

 

  
 
  Printable Version
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Query for string INSIDE Windows Event Log
  Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks! 		Page: [1]
Login
Message << Older Topic   Newer Topic >>
Query for string INSIDE Windows Event Log - 5/1/2008 1:37:13 PM   
  lem0n

 

Posts: 2
Score: 0
Joined: 5/1/2008
Status: offline 		Gentlemen,
New to the forum so please be gentle. Need to achieve the following and have been banging my head against the wall:
- In the process of deploying a full-disk encryption product that requires checkdisk to run prior to installation. If any bad sectors are found, I need to run check disk again and try to fix them. Unfortunately, check disk has no logging mechanism other then Event Viewer: upon completion Event ID 1001 with source of Winlogon is logged in Application log. Inside, it will have a string that looks like this:
0 KB in bad sectors
This is the string I need to search for INSIDE the Event ID 1001 and if it's not 0 KB, I need to stop installation and run another check disk on reboot. I have figured out a way how to do all of the above with the exception of searcing INSIDE events in Event Viewer.
If anyone has an idea or a pointer, I'd be forever greatful.
Thanks in advance!
 
 
Post #: 1
 
RE: Query for string INSIDE Windows Event Log - 5/1/2008 2:58:17 PM   
  dm_4ever


Posts: 2220
Score: 32
Joined: 6/29/2006
From: Orange County, California
Status: offline 		WMI & Win32_NTLogEvent
http://msdn.microsoft.com/en-us/library/aa394226(VS.85).aspx


      

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to lem0n)
 
 
Post #: 2
 
RE: Query for string INSIDE Windows Event Log - 5/2/2008 6:17:13 AM   
  lem0n

 

Posts: 2
Score: 0
Joined: 5/1/2008
Status: offline 		Thank you for the pointer! With little work I got this to work:

strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery("Select * from Win32_NTLogEvent Where Logfile = 'Application' and " _
& "EventCode = '1001'  AND SourceName = 'Winlogon'")
Wscript.Echo "Results of check disk: " & colLoggedEvents.Count
For each obj in colLoggedEvents
Wscript.Echo obj.Message


Dim pos
pos = InStr(1, obj.Message, "0 KB in bad sectors")
If pos = 0 Then
Wscript.Echo "Text was not found run chkdsk again"
Else
Wscript.Echo "Text was found and you do not have to run chkdsk again"
End If


Next

(in reply to dm_4ever)
 
 
Post #: 3
 
 
 
 

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Query for string INSIDE Windows Event Log Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts




Forum Software © ASPPlayground.NET Advanced Edition 2.5.5 ANSI