Sign in to follow this  
Followers 0
Nunos

WMI Query Help

3 posts in this topic

I am trying to learn how to write a script that will query the Event Logs for a specific field to see if a certain event has occured and then display the results. Below is a script that is generated in AutoIT Scriptomatic. What I would like to learn how to do is run the WMI query on multiple fields like EventIdentifier and Date so I can get a specific event and only if it has occured in the last 24 hours. I am not sure how to structure the query to say limit the results or filter them. Sorry I am probably not using the right terms. Any help is greatly appreciated. ;)

; Generated by AutoIt Scriptomatic June 09, 2012

$wbemFlagReturnImmediately = 0x10

$wbemFlagForwardOnly = 0x20

$colItems = ""

$strComputer = "localhost"

$Output=""

$Output &= "Computer: " & $strComputer & @CRLF

$Output &= "==========================================" & @CRLF

$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\")

$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent", "WQL", _

$wbemFlagReturnImmediately + $wbemFlagForwardOnly)

If IsObj($colItems) then

For $objItem In $colItems

$Output &= "Category: " & $objItem.Category & @CRLF

$Output &= "CategoryString: " & $objItem.CategoryString & @CRLF

$Output &= "ComputerName: " & $objItem.ComputerName & @CRLF

$strData = $objItem.Data(0)

$Output &= "Data: " & $strData & @CRLF

$Output &= "EventCode: " & $objItem.EventCode & @CRLF

$Output &= "EventIdentifier: " & $objItem.EventIdentifier & @CRLF

$Output &= "EventType: " & $objItem.EventType & @CRLF

$strInsertionStrings = $objItem.InsertionStrings(0)

$Output &= "InsertionStrings: " & $strInsertionStrings & @CRLF

$Output &= "Logfile: " & $objItem.Logfile & @CRLF

$Output &= "Message: " & $objItem.Message & @CRLF

$Output &= "RecordNumber: " & $objItem.RecordNumber & @CRLF

$Output &= "SourceName: " & $objItem.SourceName & @CRLF

$Output &= "TimeGenerated: " & WMIDateStringToDate($objItem.TimeGenerated) & @CRLF

$Output &= "TimeWritten: " & WMIDateStringToDate($objItem.TimeWritten) & @CRLF

$Output &= "Type: " & $objItem.Type & @CRLF

$Output &= "User: " & $objItem.User & @CRLF

if Msgbox(1,"WMI Output",$Output) = 2 then ExitLoop

$Output=""

Next

Else

Msgbox(0,"WMI Output","No WMI Objects Found for class: " & "Win32_NTLogEvent" )

Endif

Func WMIDateStringToDate($dtmDate)

Return (StringMid($dtmDate, 5, 2) & "/" & _

StringMid($dtmDate, 7, 2) & "/" & StringLeft($dtmDate, 4) _

& " " & StringMid($dtmDate, 9, 2) & ":" & StringMid($dtmDate, 11, 2) & ":" & StringMid($dtmDate,13, 2))

EndFunc

Share this post


Link to post
Share on other sites



A reference for WQL (SQL for WMI) can be found here.

Details for the Win32_NTLogEvent class can be found here.


My UDFs and Tutorials:

Spoiler

UDFs:
Active Directory (NEW 2017-04-18 - Version 1.4.8.0) - Download - General Help & Support - Example Scripts - Wiki
OutlookEX (NEW 2017-02-27 - Version 1.3.1.0) - Download - General Help & Support - Example Scripts - Wiki
ExcelChart (2015-04-01 - Version 0.4.0.0) - Download - General Help & Support - Example Scripts
Excel - Example Scripts - Wiki
Word - Wiki
PowerPoint (2015-06-06 - Version 0.0.5.0) - Download - General Help & Support

Tutorials:
ADO - Wiki

 

Share this post


Link to post
Share on other sites

Thank you Water I will read those and see if I can make sense of what I am trying to do. ;)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0