Instruction WQL pour vérifier le journal des événements d'une application

Question

Je voudrais analyser le journal des événements d'une application Windows spéciale (Windows 7 Enterprise, 64Bit).

J'ai besoin d'un événement spécial enregistré il y a quelques secondes.

Voici mon code VBScript, qui produit un résultat complètement faux (mauvais nombre d'événements):

strComputer = "." ' Dieser Computer

' Retrieving Specific Events from an Event Log

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\" & strComputer & "\root\cimv2")

Const CONVERT_TO_LOCAL_TIME = True

Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime") Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")

dtmStartDate.SetVarDate dateadd("s", -10, now()) ' CONVERT_TO_LOCAL_TIME dtmEndDate.SetVarDate now() ' CONVERT_TO_LOCAL_TIME

dim var_wql

var_wql = "SELECT * FROM Win32_NTLogEvent WHERE Logfile = '< ... >' AND SourceName = '< ... >' AND EventCode = '< ... >' AND (TimeWritten >= '" & dtmStartDate & "') AND (TimeWritten < '" & dtmEndDate & "')"

Set colLoggedEvents = objWMIService.ExecQuery(var_wql)

...

Le nombre de lignes (Anzahl = colLoggedEvents.count) doit être 0 ou 1, quoi que ce soit d'autre est impossible.

Quel est le problème avec l'instruction wql? Je voudrais vérifier les dernières secondes dans le passé (à partir de maintenant).

Merci.

Tommy

Answer 1

Erreur de syntaxe. Si je change la ligne objWMIService à cela, cela fonctionne pour moi.

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" & strComputer & "\root\cimv2") 

Mis à jour pour récupérer tous les journaux d'événements créés au cours des 10 dernières secondes et écrire dans le fichier journal.

On Error Resume Next 

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\.\root\cimv2") 
Set objFSO = CreateObject("Scripting.FileSystemObject") 
Set WshShell = WScript.CreateObject("WScript.Shell") 
strSystemDrive = WshShell.ExpandEnvironmentStrings("%SystemDrive%") 
Const CONVERT_TO_LOCAL_TIME = True 
Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime") 
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime") 
dtmStartDate.SetVarDate dateadd("s", -10, now()) ' CONVERT_TO_LOCAL_TIME 
dtmEndDate.SetVarDate now()       ' CONVERT_TO_LOCAL_TIME 
var_wql = "SELECT * FROM Win32_NTLogEvent WHERE (TimeWritten >= '" & dtmStartDate & "') AND (TimeWritten < '" & dtmEndDate & "')" 
Set LogFile = objFSO.CreateTextFile(strSystemDrive & "\Temp\EvtLog.txt", True) 

Set colLoggedEvents = objWMIService.ExecQuery(var_wql) 
For Each objEvent in colLoggedEvents 
    LogFile.WriteLine "Computer Name : " & objEvent.ComputerName 
    LogFile.WriteLine "Logfile   : " & objEvent.Logfile 
    LogFile.WriteLine "Type    : " & objEvent.Type 
    LogFile.WriteLine "User    : " & objEvent.User 
    LogFile.WriteLine "Category   : " & objEvent.Category 
    LogFile.WriteLine "Category String : " & objEvent.CategoryString 

    If IsArray(objEvent.Data) Then 
    For i = 0 To UBound(objEvent.Data) 
     strData = strData & objEvent.Data(i) & "," 
    Next 
    LogFile.WriteLine "Data    : " & strData 
    Else 
    LogFile.WriteLine "Data    : " & objEvent.Data 
    End If 

    LogFile.WriteLine "Event Code  : " & objEvent.EventCode 
    LogFile.WriteLine "Event Identifier : " & objEvent.EventIdentifier 
    LogFile.WriteLine "Message   : " & objEvent.Message 
    LogFile.WriteLine "Record Number : " & objEvent.RecordNumber 
    LogFile.WriteLine "Source Name  : " & objEvent.SourceName 
    LogFile.WriteLine "Time Generated : " & objEvent.TimeGenerated 
    LogFile.WriteLine "Time Written  : " & objEvent.TimeWritten 

    If IsArray(objEvent.InsertionStrings) Then 
    For i = 0 To UBound(objEvent.InsertionStrings) 
     strInsert = strInsert & objEvent.InsertionStrings(i) & "," 
    Next 
    LogFile.WriteLine "Insertion Strings: " & strInsert 
    Else 
    LogFile.WriteLine "Insertion Strings: " & objEvent.InsertionStrings 
    End If 

    LogFile.WriteLine "----------------------------------------------------------------------------------------------------------" 
Next 

échantillon de sortie (Tous les champs utilisés pour chaque événement) -

---------------------------------------------------------------------------------------------------------- 
Computer Name : Randy-PC 
Logfile   : Application 
Type    : Information 
User    : 
Category   : 0 
Category String : 
Data    : 
Event Code  : 9019 
Event Identifier : 1073750843 
Message   : The Desktop Window Manager was unable to start because the desktop composition setting is disabled 
Record Number : 37395 
Source Name  : Desktop Window Manager 
Time Generated : 20160903031728.000000-000 
Time Written  : 20160903031728.000000-000 
Insertion Strings: 
----------------------------------------------------------------------------------------------------------