"Babu VT" <babuvt@xxxxxx> wrote in message
news:OT%23cZjJ9JHA.4560@xxxxxx
Quote:
> Hi,
> I'm trying to get all "Error" events from Today's System event log using
> WMI.
> This is my query,
> Select * from Win32_NTLogEvent Where Logfile = 'System' And Type = 'error'
> And TimeWritten > '20090624'
>
> However this query doesn't pickup error events in earlier part of the day
> like 24/06/2009 02:00am etc. Can you please help me to find what is wrong
> here.
>
> I also tried a query something like this based on a internet search but
> still no luck,
>
> y = Year(dDate)
> m = Right("0" & Month(dDate),2)
> d = Right("0" & Day(dDate), 2)
> dteCutOffDate = y & m & d & "000000.000000" & TBias
>
> Set colLoggedEvents = objWMI.ExecQuery _
> ("Select * from Win32_NTLogEvent Where Logfile = 'System' And Type =
> 'error' And TimeWritten > '" & dteCutOffDate & "'")
>
>
> Function TBias
> Set TZone = GetObject("winmgmts:\\.\root\cimv2").ExecQuery ("select * from
> Win32_TimeZone")
> For Each Zone in TZone
> TBias = Zone.Bias
> Next
> Set TZone = Nothing
> End Function
>
>
This example from "Microsoft Windows 2000 Scripting Guide" demonstrates how
to query the logs based on the TimeWritten property:
http://www.microsoft.com/technet/scr..._log_lfas.mspx
Note the format for dates is yyyymmddHHMMSS.xxxxxx-UUU, where yyyy is the
year, mm the month, dd the day, HH the hour (24 hour format), MM the
minutes, SS the seconds, xxxxxx the milliseconds, and UUU the number of
minutes of offset from UTC.
--
Richard Mueller
MVP Directory Services
Hilltop Lab -
http://www.rlmueller.net
--