Can't find the information you are looking for here? Then leave a message over on our WinBatch Tech Support Forum.
Note The wbemFlagReturnImmediately flag is the default ExecQuery behavior and is semi-synchronous. The important optimization is the addition of the wbemFlagForwardOnly flag. Combining wbemFlagReturnImmediately with wbemFlagForwardOnly results in a forward-only enumerator. A forward-only enumerator performs much faster than the default enumerator, because WMI doesn't maintain references to objects in the SWbemObjectSet.
Reference: http://msdn.microsoft.com/library/en-us/dnclinic/html/scripting01142003.asp?frame=true
BoxOpen("Event monitor","") strComputer = "." strUser = "" strPassword = "" strNamespace = "\root\cimv2" strClass = "Win32_NTLogEvent" wbemFlagReturnImmediately = 16 wbemFlagForwardOnly = 32 objSWbemLocator = ObjectOpen("WbemScripting.SWbemLocator") objSWbemServices = objSWbemLocator.ConnectServer(strComputer,"root/cimv2",strUser,strPassword) objSWbemSecurity = objSWbemServices.Security_ objSWbemSecurity.ImpersonationLevel = 3 objSWbemPrivs = objSWbemSecurity.Privileges objSWbemPrivs.AddAsString("SeSecurityPrivilege"); Sets security privilege ;query = StrCat("SELECT * FROM " , strClass) ;Query all logs query = StrCat("SELECT * FROM " , strClass," WHERE LogFile = 'Application'") ;query = StrCat("SELECT * FROM " , strClass," WHERE LogFile = 'Security'") ;query = StrCat("SELECT * FROM " , strClass," WHERE LogFile = 'System'") colSWbemObjectSet = objSWbemServices.ExecQuery(query, "WQL",wbemFlagReturnImmediately + wbemFlagForwardOnly) objSWbemObject = ObjectCollectionOpen(colSWbemObjectSet) While @true objEvent = ObjectCollectionNext(objSWbemObject) If objEvent == 0 Then Break line = StrCat(" ",objEvent.EventCode) line = StrCat(line,", ",objEvent.SourceName) date = objEvent.TimeWritten newdate = StrCat(StrSub(date, 7, 2), "/", StrSub(date, 5, 2), "/", StrSub(date, 1, 4), " ", StrSub(date, 9, 2), ":", StrSub(date, 11, 2), ":", StrSub(date, 13, 2)) line = StrCat(line,", ",newdate, @CRLF) line = StrCat(line,objEvent.Message) line = StrReplace(line, @TAB, " ") EventType = objEvent.EventType checkevent = objEvent.EventCode BoxTitle(StrCat("Code: ",checkevent," Type: ", EventType)) BoxText(line) ObjectClose(objEvent) EndWhile ObjectCollectionClose(objSWbemObject) ObjectClose(colSWbemObjectSet) ObjectClose(objSWbemPrivs) ObjectClose(objSWbemSecurity) ObjectClose(objSWbemServices) ObjectClose(objSWbemLocator)
Article ID: W16268
File Created: 2004:04:07:14:23:40
Last Updated: 2004:04:07:14:23:40