sql query eventviewer logs

[gcue]

hello world

i am not sure why I am not getting results from this.. when in fact there are errors that fit the criteria

$host = "localhost"

$objWMIService = ObjGet("winmgmts:\\" & $host & "\root\cimv2")

$past_15days = _DateAdd("D", -15, _NowCalc())
$past_15days = StringReplace($past_15days, "/", "")
$past_15days = StringReplace($past_15days, ":", "")
$past_15days = StringStripWS($past_15days, 8)

$Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile='Application' AND Type='Error' AND TimeWritten>'" & $past_15days & "'"

$colItems = $objWMIService.ExecQuery($Query_Clause)

$count = 0

If IsObj($colItems) Then
For $objEvent In $colItems
;~  $time_stamp = $objEvent.TimeWritten
;~  debug($time_stamp, $past_15days)

$error = $objEvent.Message

consolewrite($error & @crlf)

$count += 1
Next
EndIf

I tried with and without the single quotes around $past_15days

I know I can probably do this in one shot (getting the count which I have not been able to try yet since I cannot get accurate results)

thanks in advance!

Edited February 12, 2013 by gcue

[BrewManNH]

What format does the date have to be in for this to work?

[gcue]

yyyymmddhhmmss

[gcue]

or do you mean string, binary, number?

i tried all 3

$past_15days = Number($past_15days)

etc

[BrewManNH]

_NowCalc returns the date/time in a different format.

_NowCalc

Returns the current Date and Time in format YYYY/MM/DD HH:MM:SS for use in date calculations.

[gcue]

right. that's why i change the format to yyyymmddhhmmss using this:

$past_15days = _DateAdd("D", -15, _NowCalc())
$past_15days = StringReplace($past_15days, "/", "")
$past_15days = StringReplace($past_15days, ":", "")
$past_15days = StringStripWS($past_15days, 8)

Edited February 12, 2013 by gcue

[jchd]

The following works for me:

#include 

$host = "localhost"

$objWMIService = ObjGet("winmgmts:\\" & $host & "\root\cimv2")

$past_15days = _DateAdd("D", -15, _NowCalc())
$past_15days = StringReplace($past_15days, "/", "")
$past_15days = StringReplace($past_15days, ":", "")
$past_15days = StringStripWS($past_15days, 8)
$past_15days &= ".000000-000"
ConsoleWrite("From: " & $past_15days & @LF)

;~ $Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile='Application' AND Type='Error' AND TimeWritten>'" & $past_15days & "'"
$Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile='Application' AND TimeWritten>'" & $past_15days & "'"

$colItems = $objWMIService.ExecQuery($Query_Clause)

If IsObj($colItems) Then
ConsoleWrite("Number of events: " & $colItems.count & @LF)
For $objEvent In $colItems
$time_stamp = $objEvent.TimeWritten
$error = $objEvent.Message
ConsoleWrite($time_stamp & " -> " & $error & @LF)
Next
EndIf

But I wonder if the format will do for you: I'm running a French version with datetime locale format YMD... not a US local (maybe YDM or something even weirder). MSDN is clear as mud on this (as usual now).

[gcue]

that worked!

i was also trying this:

ROUND(TimeWritten,0)>='" & $past_15days & "'"

which didn't work

thank you for your help!!!

Edited February 12, 2013 by gcue

[gcue]

also, how would i get the count in one shot?

this isnt' working..

$Query_Clause = "Select COUNT(*) FROM Win32_NTLogEvent WHERE Logfile='Application' AND Type='Error' AND TimeWritten>'" & $past_15days & "'"

$colItems = $objWMIService.ExecQuery($Query_Clause)

_arraydisplay($colitems)

[gcue]

nvm found it

$count = $colItems.Count

thanks again!