Best way to pull event logs

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

Best way to pull event logs

Logged in as: Guest

arrSession:exec spGetSession 2,2,62177

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> WSH & Client Side VBScript >> Best way to pull event logs
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

Best way to pull event logs - 7/7/2008 2:38:49 AM

cr4z3d

Posts: 1
Score: 0
Joined: 7/7/2008
Status: offline

I'm writing a script that will pull a bunch of information off of a server using WMI. It currently runs fine, but the section that pulls event logs takes a very long time if there are a log of events. What it needs to do is search through each event log for errors and write one of each error to a text file and how many times that error occurs. I've tried writing this script using semi synchronous querying as well as asynchronously (obviously default querying as well). I'm looking for a way to improve the following bit of code. Does anyone have a suggestion? I really have spent many hours trying to make this code as efficient as possible.. but nothing seems to make it work as quick as I'd like it to. This code also backs up and clears the logs after searching through each one.

Note: ignore unkown variables in BackUpLogs() they are defined elsewhere in the script this is only a small section

Sub GetLogErrors

Dim objEvent            ' the event being worked on
   Dim colLoggedEvents        ' collection of events
   Dim objWMIService        ' the WMI connection
   Dim listEventLogs        ' a string containing all the names of event logs (comma seperated)
   Dim arrEventLogs        ' an array containing all event logs, created from listEventLogs
   Dim eventLogName        ' current event log being worked on
   Dim objEventCodes        ' dictionary object logging each error code and how many times it occured
   Dim timeWritten            ' human readable time format, much better than standard output
   Dim k                    ' basic counter

Log ""
   Log "========================"
   Log "Event Logs"
   Log "========================"
   Log ""

Set objWMIService = GetObject("winmgmts:" _
       & "{impersonationLevel=impersonate}!\\" & strServerName & "\root\cimv2")

' create an array of each event log name
   Set colLoggedEvents = objWMIService.InstancesOf("Win32_NTEventLogFile")
   
   ReDim arrEventLogs(colLoggedEvents.Count - 1)
   
   Dim i ' counter
   i = 0
   For Each objEvent in colLoggedEvents
       arrEventLogs(i) = objEvent.LogFileName        
       i = i + 1
   Next

Set objEventCodes = CreateObject("Scripting.Dictionary")

' loop through the array and output one of each error
   For Each eventLogName in arrEventLogs

Log ""
       Log eventLogName
       Log "=============================================================="
       Set colLoggedEvents = objWMIService.ExecQuery _
       ("Select * from Win32_NTLogEvent Where Type = 'Error' and Logfile = '" & eventLogName &"'",,48)    
       ' 48 makes this a semi-synchronous search (better performance on machines with large amounts of events)
       
       
       k = 0
       For Each objEvent in colLoggedEvents
           k = k + 1
           If Not objEventCodes.Exists(objEvent.EventCode) Then            
           
               objEventCodes.Add objEvent.EventCode, 1
               Set timeWritten = CreateObject( _
                   "WbemScripting.SWbemDateTime")
               
               timeWritten.Value = objEvent.TimeWritten

Log "Category: " & objEvent.Category
               Log "Computer Name: " & objEvent.ComputerName
               Log "Event Code: " & objEvent.EventCode
               Log "Message: " & objEvent.Message
               Log "Record Number: " & objEvent.RecordNumber
               Log "Source Name: " & objEvent.SourceName
               Log "Time Written: " & timeWritten.GetVarDate
               Log "Event Type: " & objEvent.Type
               Log "User: " & objEvent.User
               Log "----------------------------"
               
               Set tempCount = Nothing
           End If
       Next
       If k = 0 Then
           Log "No Errors"
       End If
       
       objEventCodes.RemoveAll
       
       BackUpLogs(eventLogName)    
   Next

End Sub

Sub BackUpLogs(ByVal strLogName)

Dim objWMIService, colLogFiles, objLogFile, errBackupLog
   
   ' replace spaces in log name
   
   
   Set objWMIService = GetObject("winmgmts:" _
       & "{impersonationLevel=impersonate,(Backup)}!\\" & _
       strServerName & "\root\cimv2")
   Set colLogFiles = objWMIService.ExecQuery _
       ("SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='" & strLogName & "'")
       
   strLogName = Replace(strLogName, " ", "_")
   For Each objLogfile in colLogFiles
       errBackupLog = objLogFile.BackupEventLog(usrFileLoc & "\" & strLogName & "-" & dateTime & "-" & strInitials & ".evt")
       If errBackupLog <> 0 Then
           'Wscript.Echo "The Application event log could not be backed up."
           ' event log is already cleared nothing needs to be done
       Else
           objLogFile.ClearEventLog()
       End If
   Next
End Sub

Post #: 1

RE: Best way to pull event logs - 7/7/2008 4:07:12 AM

ebgreen

Posts: 5041
Score: 31
Joined: 7/12/2005
Status: offline

My only suggestion would be to spawn separate threads to query and collect the information for each log type. Each thread could save the compiled information out to a text file then your main script could collect and read the individual files. I don't know for sure that this would give you a speed boost, but it may.

_____________________________

"... when you are good and crazy, oooh, oooh, oooh, the sky is the limit!" - The Tick
Goog places to start:http://www.visualbasicscript.com/m_24727/tm.htm
http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to cr4z3d)

Post #: 2

RE: Best way to pull event logs - 7/7/2008 6:28:12 PM

4scriptmoni

Posts: 208
Score: 0
Joined: 5/3/2007
Status: offline

I find it much faster using dumpel
here is the function I used, I monitor few events in about hundres of servers and it would email me everytime the event is present.
Download dumpel from M$

If u need I can send the whole script...

Function Execute(eType,eSource,eError,eServer,eDays)
   on error resume next
   blnErrorFound = False
   EventDumplog = EventDumpPath & eServer & "_" & eError & ".txt"
   dim strCmd,strCmdOut
   dim objShell : Set objShell = WScript.CreateObject("WScript.Shell")

strCmd = strScriptPath & "dumpel.exe -f " & EventDumpLog & " -l " & eType & " -m " & eSource & " -e " & eError & " -s " & eServer & " -d " & eDays    
   'wscript.echo strCmd    
   Dim objExecObject : Set objExecObject = objShell.Exec(strCmd)    
'MUST GET STDOUT, SOMETIMES APP DONT RUN!
   Do While objExecObject.Status <> 1        
       wscript.sleep 2000    
       'Wscript.StdOut.Write(".")        
   Loop    
   
   if err.number = 0 and objExecObject.Status = 1 then     
       
   end if

end function

sub CheckIfError(eLog,ePath)
'Looks into Log folder if any .txt and not 0kb turn ErrorFound=true that will zip and send email
   Dim fs,f,f1,fc
   dumpFileCnt = 0
   'wscript.echo "Checking if errors: " & epath & eLog
   Dim ofso : Set ofso = CreateObject("Scripting.FileSystemObject")    
   Set fs = CreateObject("Scripting.FileSystemObject")    
       Set f = fs.GetFolder(ePath)
       Set fc = f.Files
       For Each f1 in fc            
           'IF 0KB then Delete                
           If ( (f1.size =0) And (UCase(right(f1.name,4))=UCase(".txt")) ) Then
               f1.delete
           elseif  (f1.size <> 0) and (f1.name = eLog) Then                                    
               if f1.size < 900000 then 'If over 200Kb dont even Open
                   Dim dumpFile: Set dumpFile = ofso.OpenTextFile(f1.path, 1)
                   Do While Not dumpFile.AtEndOfStream                         
                           dumpFileCnt = dumpFileCnt + 1
                           if DumpFilecnt = 1 then 
                               strLine = dumpFile.ReadLine
                           elseif DumpFilecnt > 450 then
                            exit do
                           end if
                   loop                                        
               end if 'File Dump Size Check
               DumpFilecnt = "Event dump File Size = " & toMegabytes(f1.size)
               blnErrorFound = True
           end if    
       Next ' Next File    
end sub

_____________________________

Enterprise Microsoft Scripts
Exchange, Login/Logout Monitor,TS, Monitoring, Security, AD, etc...
http://www.felipeferreira.net

(in reply to cr4z3d)

Post #: 3

RE: Best way to pull event logs - 7/7/2008 11:34:00 PM

ginolard

Posts: 1053
Score: 21
Joined: 8/10/2005
Status: offline

I find the best way to pull event logs is to sidle up to them, give them a warm smile and offer to buy them a drink

_____________________________

Author of ManagePC - http://managepc.net
AD Query Template - http://www.visualbasicscript.com/m_40609/tm.htm
Consolidated Scripting Framework - http://www.visualbasicscript.com/m_59109/tm.htm

(in reply to 4scriptmoni)

Post #: 4

RE: Best way to pull event logs - 7/8/2008 12:21:14 AM

dm_4ever

Posts: 2665
Score: 46
Joined: 6/29/2006
From: Orange County, California
Status: offline

You might also consider logparser....it allows you to query the event log in a very SQL like manner so you can use Distinct, Count, and other function to get you want you want....it can also query offline files if I remember correctly...so you may just worry about backing up the event log...maybe copy them to a central location and have a specific machine go through parsing the data and logging it.

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to cr4z3d)

Post #: 5

RE: Best way to pull event logs - 7/8/2008 3:19:19 AM

Rischip

Posts: 502
Score: 2
Joined: 3/26/2007
Status: offline

Here's a good article about your topic. http://www.sqlmag.com/Articles/Print.cfm?ArticleID=49492

_____________________________

Rischip
Author of - The Grim Linker

(in reply to dm_4ever)

Post #: 6

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.

All Forums >> [Scripting] >> WSH & Client Side VBScript >> Best way to pull event logs

Page: [1]

Jump to:

New Messages	No New Messages
Hot Topic w/ New Messages	Hot Topic w/o New Messages
Locked w/ New Messages	Locked w/o New Messages

Post New Thread

Reply to Message

Post New Poll

Submit Vote

Delete My Own Post

Delete My Own Thread

Rate Posts