"George" <Geo***@discussions.microsoft.com> wrote in message
news:6EB13CFD-DF52-4908-A39D-8E1B7C102620@microsoft.com...
> Hi ,
>
> I am running a script to find the event log errors for a group of servers.
>
> --------------------
> Const ForReading = 1
> Const ForAppending = 8
> Const CONVERT_TO_LOCAL_TIME = True
>
>
> Set objFSO = CreateObject("Scripting.FileSystemObject")
> Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
> Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
> DateToCheck = CDate("4/3/2007")
> dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
> dtmEndDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME
>
> Set objTextFile = objFSO.OpenTextFile _
>    ("C:\servers.txt", ForReading)
>
> Set objTextFile1 = objFSO.OpenTextFile _
>    ("C:\service_status.txt", ForAppending, True)
>
>
> Set objTextFile2 = objFSO.OpenTextFile _
>    ("C:\log_status.txt", ForAppending, True)
>
> Do Until objTextFile.AtEndOfStream
>    strNextLine = objTextFile.Readline
>    arrServiceList = Split(strNextLine , ",")
>
>
> strComputer = arrServiceList(0)
>
> Set objWMIService = GetObject("winmgmts:" _
>    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
>
>
>
> Set colRunningServices = objWMIService.ExecQuery("Select * from
> Win32_Service")
>
> For Each objService in colRunningServices
> if  objService.StartMode = "Auto" then
> if objService.State= "Stopped" then
> objTextFile1.WriteLine arrServiceList(0) &vbtab & objService.DisplayName
> &
> VbTab & objService.State
> End if
> End if
> Next
> Set colEvents = objWMIService.ExecQuery _
>    ("Select * from Win32_NTLogEvent Where TimeWritten >= '"  &
> dtmStartDate
> & "' and TimeWritten < '" & dtmEndDate & "'")
>
>
> For Each objEvent in colEvents
>
> if  objEvent.Type = "error"  then
> objTextfile2.WriteLine  "Computer Name: " & arrServiceList(0) _
>    & vbtab & objEvent.SourceName _
>    & vbtab & objEvent.TimeWritten _
>    & vbtab & objEvent.Type _
>    & vbtab & objEvent.User
> End if
> Next
>
>
> Loop
> ----------------------------
> The problem is this script checks the logs only for the day 4/3/2007.
>
> I want to find the log error for period of time. For example: The time now
> to last 7 days. ie. 4/3/2007 to 4/10/2007..
>
> Please help me in this.
>
> Regards,
> George.
>

"Richard Mueller [MVP]" wrote:

> To query from 4/3/2007 to 4/10/2007 you should use:
>
> DateToCheck = CDate("4/3/2007")
> dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
> dtmEndDate.SetVarDate DateToCheck +7, CONVERT_TO_LOCAL_TIME
>
> Or, to make the code more generic, I would suggest:
>
> DateToCheck = Now()
> dtmStartDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME
> dtmEndDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
>
> --
> Richard Mueller
> Microsoft MVP Scripting and ADSI
> Hilltop Lab - http://www.rlmueller.net
> --
>
> "George" <Geo***@discussions.microsoft.com> wrote in message
> news:6EB13CFD-DF52-4908-A39D-8E1B7C102620@microsoft.com...
> > Hi ,
> >
> > I am running a script to find the event log errors for a group of servers.
> >
> > --------------------
> > Const ForReading = 1
> > Const ForAppending = 8
> > Const CONVERT_TO_LOCAL_TIME = True
> >
> >
> > Set objFSO = CreateObject("Scripting.FileSystemObject")
> > Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
> > Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
> > DateToCheck = CDate("4/3/2007")
> > dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
> > dtmEndDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME
> >
> > Set objTextFile = objFSO.OpenTextFile _
> >    ("C:\servers.txt", ForReading)
> >
> > Set objTextFile1 = objFSO.OpenTextFile _
> >    ("C:\service_status.txt", ForAppending, True)
> >
> >
> > Set objTextFile2 = objFSO.OpenTextFile _
> >    ("C:\log_status.txt", ForAppending, True)
> >
> > Do Until objTextFile.AtEndOfStream
> >    strNextLine = objTextFile.Readline
> >    arrServiceList = Split(strNextLine , ",")
> >
> >
> > strComputer = arrServiceList(0)
> >
> > Set objWMIService = GetObject("winmgmts:" _
> >    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
> >
> >
> >
> > Set colRunningServices = objWMIService.ExecQuery("Select * from
> > Win32_Service")
> >
> > For Each objService in colRunningServices
> > if  objService.StartMode = "Auto" then
> > if objService.State= "Stopped" then
> > objTextFile1.WriteLine arrServiceList(0) &vbtab & objService.DisplayName
> > &
> > VbTab & objService.State
> > End if
> > End if
> > Next
> > Set colEvents = objWMIService.ExecQuery _
> >    ("Select * from Win32_NTLogEvent Where TimeWritten >= '"  &
> > dtmStartDate
> > & "' and TimeWritten < '" & dtmEndDate & "'")
> >
> >
> > For Each objEvent in colEvents
> >
> > if  objEvent.Type = "error"  then
> > objTextfile2.WriteLine  "Computer Name: " & arrServiceList(0) _
> >    & vbtab & objEvent.SourceName _
> >    & vbtab & objEvent.TimeWritten _
> >    & vbtab & objEvent.Type _
> >    & vbtab & objEvent.User
> > End if
> > Next
> >
> >
> > Loop
> > ----------------------------
> > The problem is this script checks the logs only for the day 4/3/2007.
> >
> > I want to find the log error for period of time. For example: The time now
> > to last 7 days. ie. 4/3/2007 to 4/10/2007..
> >
> > Please help me in this.
> >
> > Regards,
> > George.
> >
>
>
>

"George" <Geo***@discussions.microsoft.com> wrote in message
news:0F87A4A2-074A-4DBD-8610-232D8808E8B0@microsoft.com...
> Hi Richard,
>
> I had changed start and end date. But still it is returning the 'error'
> events for the day 3/4/2007
>
> The query passing is
>
> Select * from Win32_NTLogEvent Where TimeWritten >=
> '20070403091237.000000-240' and TimeWritten < '20070410091237.000000-240'
>
> Please help me in this.
>
> Regards,
> George.
>
> "Richard Mueller [MVP]" wrote:
>
>> To query from 4/3/2007 to 4/10/2007 you should use:
>>
>> DateToCheck = CDate("4/3/2007")
>> dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
>> dtmEndDate.SetVarDate DateToCheck +7, CONVERT_TO_LOCAL_TIME
>>
>> Or, to make the code more generic, I would suggest:
>>
>> DateToCheck = Now()
>> dtmStartDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME
>> dtmEndDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
>>
>> --
>> Richard Mueller
>> Microsoft MVP Scripting and ADSI
>> Hilltop Lab - http://www.rlmueller.net
>> --
>>
>> "George" <Geo***@discussions.microsoft.com> wrote in message
>> news:6EB13CFD-DF52-4908-A39D-8E1B7C102620@microsoft.com...
>> > Hi ,
>> >
>> > I am running a script to find the event log errors for a group of
>> > servers.
>> >
>> > --------------------
>> > Const ForReading = 1
>> > Const ForAppending = 8
>> > Const CONVERT_TO_LOCAL_TIME = True
>> >
>> >
>> > Set objFSO = CreateObject("Scripting.FileSystemObject")
>> > Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
>> > Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
>> > DateToCheck = CDate("4/3/2007")
>> > dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
>> > dtmEndDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME
>> >
>> > Set objTextFile = objFSO.OpenTextFile _
>> >    ("C:\servers.txt", ForReading)
>> >
>> > Set objTextFile1 = objFSO.OpenTextFile _
>> >    ("C:\service_status.txt", ForAppending, True)
>> >
>> >
>> > Set objTextFile2 = objFSO.OpenTextFile _
>> >    ("C:\log_status.txt", ForAppending, True)
>> >
>> > Do Until objTextFile.AtEndOfStream
>> >    strNextLine = objTextFile.Readline
>> >    arrServiceList = Split(strNextLine , ",")
>> >
>> >
>> > strComputer = arrServiceList(0)
>> >
>> > Set objWMIService = GetObject("winmgmts:" _
>> >    & "{impersonationLevel=impersonate}!\\" & strComputer &
>> > "\root\cimv2")
>> >
>> >
>> >
>> > Set colRunningServices = objWMIService.ExecQuery("Select * from
>> > Win32_Service")
>> >
>> > For Each objService in colRunningServices
>> > if  objService.StartMode = "Auto" then
>> > if objService.State= "Stopped" then
>> > objTextFile1.WriteLine arrServiceList(0) &vbtab &
>> > objService.DisplayName
>> > &
>> > VbTab & objService.State
>> > End if
>> > End if
>> > Next
>> > Set colEvents = objWMIService.ExecQuery _
>> >    ("Select * from Win32_NTLogEvent Where TimeWritten >= '"  &
>> > dtmStartDate
>> > & "' and TimeWritten < '" & dtmEndDate & "'")
>> >
>> >
>> > For Each objEvent in colEvents
>> >
>> > if  objEvent.Type = "error"  then
>> > objTextfile2.WriteLine  "Computer Name: " & arrServiceList(0) _
>> >    & vbtab & objEvent.SourceName _
>> >    & vbtab & objEvent.TimeWritten _
>> >    & vbtab & objEvent.Type _
>> >    & vbtab & objEvent.User
>> > End if
>> > Next
>> >
>> >
>> > Loop
>> > ----------------------------
>> > The problem is this script checks the logs only for the day 4/3/2007.
>> >
>> > I want to find the log error for period of time. For example: The time
>> > now
>> > to last 7 days. ie. 4/3/2007 to 4/10/2007..
>> >
>> > Please help me in this.
>> >
>> > Regards,
>> > George.
>> >
>>
>>
>>

"Richard Mueller [MVP]" wrote:

> The query works for me and returns 7 days of events from April 3 through
> April 10. The UTC format for dates is independent of the locale setting, so
> I don't see how you can get events for March with the query you show. The
> UTC format is:
>
> YYYYMMDDhhmmss.xxxxxx-zzz
>
> where YYYY is the four digit year, MM the month, DD the day, hh the hours
> (24 hour clock), mm the minutes, ss the seconds, xxxxxx the milliseconds,
> and zzz the time zone offset.
>
> One thought. You test for event type "error", but I believe it is "Error".
> You might want to use LCase to make the check case insensitive:
>
> If (LCase(objEvent.Type) = "error") Then
>
> --
> Richard Mueller
> Microsoft MVP Scripting and ADSI
> Hilltop Lab - http://www.rlmueller.net
> --
>
> "George" <Geo***@discussions.microsoft.com> wrote in message
> news:0F87A4A2-074A-4DBD-8610-232D8808E8B0@microsoft.com...
> > Hi Richard,
> >
> > I had changed start and end date. But still it is returning the 'error'
> > events for the day 3/4/2007
> >
> > The query passing is
> >
> > Select * from Win32_NTLogEvent Where TimeWritten >=
> > '20070403091237.000000-240' and TimeWritten < '20070410091237.000000-240'
> >
> > Please help me in this.
> >
> > Regards,
> > George.
> >
> > "Richard Mueller [MVP]" wrote:
> >
> >> To query from 4/3/2007 to 4/10/2007 you should use:
> >>
> >> DateToCheck = CDate("4/3/2007")
> >> dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
> >> dtmEndDate.SetVarDate DateToCheck +7, CONVERT_TO_LOCAL_TIME
> >>
> >> Or, to make the code more generic, I would suggest:
> >>
> >> DateToCheck = Now()
> >> dtmStartDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME
> >> dtmEndDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
> >>
> >> --
> >> Richard Mueller
> >> Microsoft MVP Scripting and ADSI
> >> Hilltop Lab - http://www.rlmueller.net
> >> --
> >>
> >> "George" <Geo***@discussions.microsoft.com> wrote in message
> >> news:6EB13CFD-DF52-4908-A39D-8E1B7C102620@microsoft.com...
> >> > Hi ,
> >> >
> >> > I am running a script to find the event log errors for a group of
> >> > servers.
> >> >
> >> > --------------------
> >> > Const ForReading = 1
> >> > Const ForAppending = 8
> >> > Const CONVERT_TO_LOCAL_TIME = True
> >> >
> >> >
> >> > Set objFSO = CreateObject("Scripting.FileSystemObject")
> >> > Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
> >> > Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
> >> > DateToCheck = CDate("4/3/2007")
> >> > dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
> >> > dtmEndDate.SetVarDate DateToCheck -7, CONVERT_TO_LOCAL_TIME
> >> >
> >> > Set objTextFile = objFSO.OpenTextFile _
> >> >    ("C:\servers.txt", ForReading)
> >> >
> >> > Set objTextFile1 = objFSO.OpenTextFile _
> >> >    ("C:\service_status.txt", ForAppending, True)
> >> >
> >> >
> >> > Set objTextFile2 = objFSO.OpenTextFile _
> >> >    ("C:\log_status.txt", ForAppending, True)
> >> >
> >> > Do Until objTextFile.AtEndOfStream
> >> >    strNextLine = objTextFile.Readline
> >> >    arrServiceList = Split(strNextLine , ",")
> >> >
> >> >
> >> > strComputer = arrServiceList(0)
> >> >
> >> > Set objWMIService = GetObject("winmgmts:" _
> >> >    & "{impersonationLevel=impersonate}!\\" & strComputer &
> >> > "\root\cimv2")
> >> >
> >> >
> >> >
> >> > Set colRunningServices = objWMIService.ExecQuery("Select * from
> >> > Win32_Service")
> >> >
> >> > For Each objService in colRunningServices
> >> > if  objService.StartMode = "Auto" then
> >> > if objService.State= "Stopped" then
> >> > objTextFile1.WriteLine arrServiceList(0) &vbtab &
> >> > objService.DisplayName
> >> > &
> >> > VbTab & objService.State
> >> > End if
> >> > End if
> >> > Next
> >> > Set colEvents = objWMIService.ExecQuery _
> >> >    ("Select * from Win32_NTLogEvent Where TimeWritten >= '"  &
> >> > dtmStartDate
> >> > & "' and TimeWritten < '" & dtmEndDate & "'")
> >> >
> >> >
> >> > For Each objEvent in colEvents
> >> >
> >> > if  objEvent.Type = "error"  then
> >> > objTextfile2.WriteLine  "Computer Name: " & arrServiceList(0) _
> >> >    & vbtab & objEvent.SourceName _
> >> >    & vbtab & objEvent.TimeWritten _
> >> >    & vbtab & objEvent.Type _
> >> >    & vbtab & objEvent.User
> >> > End if
> >> > Next
> >> >
> >> >
> >> > Loop
> >> > ----------------------------
> >> > The problem is this script checks the logs only for the day 4/3/2007.
> >> >
> >> > I want to find the log error for period of time. For example: The time
> >> > now
> >> > to last 7 days. ie. 4/3/2007 to 4/10/2007..
> >> >
> >> > Please help me in this.
> >> >
> >> > Regards,
> >> > George.
> >> >
> >>
> >>
> >>
>
>
>