Best Way to Read Event Log via WMI

If you're working with a managed resource that returns a lot of instances (we'll define a lot as more than 1000 for the purpose of this discussion), you can optimize the behavior of ExecQuery through the use of optional flags. For example, suppose you use ExecQuery to query Event Log records (modeled by the Win32_NTLogEvent class). As you already know, the Event Log(s) can contain thousands and thousands of records. By default, you may encounter performance problems associated with queries that return large result sets, such as Event Log queries. The reason has to do with the way WMI caches a SWbemObject reference for each and every instance, or in our example, for each and every Event Log record. To avoid the problem, you can tell ExecQuery to return a forward-only SWbemObjectSet, as demonstrated below.

Note The wbemFlagReturnImmediately flag is the default ExecQuery behavior and is semi-synchronous. The important optimization is the addition of the wbemFlagForwardOnly flag. Combining wbemFlagReturnImmediately with wbemFlagForwardOnly results in a forward-only enumerator. A forward-only enumerator performs much faster than the default enumerator, because WMI doesn't maintain references to objects in the SWbemObjectSet.

Reference: http://msdn.microsoft.com/library/en-us/dnclinic/html/scripting01142003.asp?frame=true

BoxOpen("Event monitor","")

strComputer = "."
strUser = ""
strPassword = "" 
strNamespace = "\root\cimv2"
strClass = "Win32_NTLogEvent"

wbemFlagReturnImmediately = 16
wbemFlagForwardOnly = 32

objSWbemLocator = ObjectOpen("WbemScripting.SWbemLocator")
objSWbemServices = objSWbemLocator.ConnectServer(strComputer,"root/cimv2",strUser,strPassword)
objSWbemSecurity = objSWbemServices.Security_
objSWbemSecurity.ImpersonationLevel = 3
objSWbemPrivs = objSWbemSecurity.Privileges
objSWbemPrivs.AddAsString("SeSecurityPrivilege"); Sets security privilege

;query =  StrCat("SELECT * FROM " , strClass) ;Query all logs
query =  StrCat("SELECT * FROM " , strClass," WHERE LogFile = 'Application'")
;query =  StrCat("SELECT * FROM " , strClass," WHERE LogFile = 'Security'")
;query =  StrCat("SELECT * FROM " , strClass," WHERE LogFile = 'System'")

colSWbemObjectSet = objSWbemServices.ExecQuery(query, "WQL",wbemFlagReturnImmediately + wbemFlagForwardOnly)

objSWbemObject = ObjectCollectionOpen(colSWbemObjectSet)

While @true
	objEvent = ObjectCollectionNext(objSWbemObject)
	If objEvent == 0 Then Break
	
	line = StrCat(" ",objEvent.EventCode)
	line = StrCat(line,", ",objEvent.SourceName)
	date = objEvent.TimeWritten
	newdate = StrCat(StrSub(date, 7, 2), "/", StrSub(date, 5, 2), "/", StrSub(date, 1, 4), " ", StrSub(date, 9, 2), ":", StrSub(date, 11, 2), ":", StrSub(date, 13, 2))
	line = StrCat(line,", ",newdate, @CRLF)
	line = StrCat(line,objEvent.Message)
	line = StrReplace(line, @TAB, " ")
	EventType = objEvent.EventType
	checkevent = objEvent.EventCode
	BoxTitle(StrCat("Code: ",checkevent," Type: ", EventType))
	BoxText(line)
	ObjectClose(objEvent)
EndWhile

ObjectCollectionClose(objSWbemObject)
ObjectClose(colSWbemObjectSet)
ObjectClose(objSWbemPrivs)
ObjectClose(objSWbemSecurity)
ObjectClose(objSWbemServices)
ObjectClose(objSWbemLocator)

Article ID:   W16268

File Created: 2004:04:07:14:23:40

Last Updated: 2004:04:07:14:23:40

Database Search

TechHome

Best Way to Read Event Log via WMI