Using Instr in WMI Query

myITforum.com Community Forum

Home Forums Blogs Live Support chat Search Articles Wiki FAQ Email Lists Register Login My Profile Inbox Address Book My Subscription My Forums

Photo Gallery Member List Search Calendars FAQ Ticket List Log Out

All Forums RSS Feed Subscription:

Using Instr in WMI Query

View related threads: (in this forum | in all forums)

Logged in as: Guest

Printable Version

All Forums >> [Scripting Technologies] >> VB Script >> Using Instr in WMI Query

Page: [1]

Message

<< Older Topic Newer Topic >>

Using Instr in WMI Query - 6/2/2008 1:17:23 PM

fracine

Posts: 1619
Score: 23
Joined: 11/17/2001
From: Québec, Canada
Status: offline

I am trying to query a specific Event on a server:

This Query will list all computers with that particular event id for a specific delay:
Set colEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where Logfile = 'Application' AND " _
            & "EventCode = '1004' and TimeWritten >= '" _
        & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")

As soon as I am trying to filter a little deepeer with a particular computer name in the message then a get a null result.

Set colEvents = objWMIService.ExecQuery _
   ("Select * from Win32_NTLogEvent Where Logfile = 'Application' AND " _
           & "EventCode = '1004' AND InStr(Message,strcomputername)>'0' and TimeWritten >= '" _
       & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")

Dim dtmBeginDate
Dim dtmCurrentDate
Dim dtmEndDate
Dim dtmStartDate
Dim dtmTomorrowdayDate
Dim dTmWritten
Dim strBias
Dim strComputer
Dim strComputername
Set objShell   = CreateObject("WScript.Shell")
'strComputername = objShell.ExpandEnvironmentStrings("%computername%")
strComputername = "T5021"
strComputer = "SGSCT03"
'Date en format Date
dtmCurrentDate = Date
'Date d'hier en format Date
dtmBeginDate = DateAdd("d",-1,dtmCurrentDate)
'Date de demain
dtmTomorrowdayDate = DateAdd("d",1,dtmCurrentDate)
'WScript.Echo dtmBeginDate
'WScript.Echo dtmTomorrowdayDate
'Connexion à WMI
Set objWMIService = GetObject("winmgmts:" _
   & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

'===========
'On se connecte à la classe Win32_TimeZone
Set colTimeZone = objWMIService.ExecQuery _
   ("SELECT * FROM Win32_TimeZone")

'On recherche le BIAIS pour le timezone
For Each objTimeZone in colTimeZone
   strBias = objTimeZone.Bias
   'WScript.Echo strBias
Next
'Correspond à l'heure 0 de la journée d'hier en format UTC. On converti la date d'hier en format date vers le format UTC
dtmStartDate=DateToUTC(dtmBeginDate)
'Correspond à l'heure 0 de la journée Fin en format UTC. On converti la date de demain en format date vers le format UTC
dtmEndDate=DateToUTC(dtmTomorrowdayDate)
WScript.echo dtmStartDate
WScript.Echo dtmEndDate
'===========
' Set colEvents = objWMIService.ExecQuery _
'     ("Select * from Win32_NTLogEvent Where Logfile = 'Application' AND " _
'             & "EventCode = '1004' and TimeWritten >= '" _
'         & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")
Set colEvents = objWMIService.ExecQuery _
   ("Select * from Win32_NTLogEvent Where Logfile = 'Application' AND " _
           & "EventCode = '1004' AND InStr(Message,strcomputername)>'0' and TimeWritten >= '" _
       & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")

For Each objEvent in colEvents
   Wscript.Echo "Category: " & objEvent.Category
   Wscript.Echo "Computer Name: " & objEvent.ComputerName
   Wscript.Echo "Event Code: " & objEvent.EventCode
   Wscript.Echo "Message: " & objEvent.Message
   Wscript.Echo "Record Number: " & objEvent.RecordNumber
   Wscript.Echo "Source Name: " & objEvent.SourceName
   dTmWritten=UTCToDate(objEvent.TimeWritten)
   Wscript.Echo "Time Written: " & objEvent.TimeWritten & " " & dTmWritten
   Wscript.Echo "Event Type: " & objEvent.Type
   Wscript.Echo "User: " & objEvent.User
   Wscript.Echo objEvent.LogFile
   Wscript.Echo InStr(objEvent.Message,strcomputername)
Next
'========================================================================
Function DateToUTC(dtmTargetDate)
dtmtestdate=dtmTargetDate
WScript.Echo dtmtestdate
dtmTargetDate = Year(dtmTargetDate)
'Wscript.Echo dtmTargetDate
dtmMonth = Month(dtmtestdate)
WScript.Echo dtmMonth
If Len(dtmMonth) = 1 Then
   dtmMonth = "0" & dtmMonth
End If
dtmTargetDate = dtmTargetDate & dtmMonth
'Wscript.Echo dtmTargetDate
dtmDay = Day(dtmtestdate)
If Len(dtmDay) = 1 Then
   dtmDay = "0" & dtmDay
End If
dtmTargetDate = dtmTargetDate & dtmDay & "000000.000000"
dtmTargetDate = dtmTargetDate & Cstr(strBias)
' MsgBox(dtmtestdate & " " & dtmTargetDate)
DateToUTC=dtmTargetDate
End Function
'========================================================================
Function UTCToDate(dtmTargetDate)
WScript.Echo dtmTargetDate
UTCToDate = CDate(Mid(dtmTargetDate, 5, 2) & "/" & _
        Mid(dtmTargetDate, 7, 2) & "/" & Left(dtmTargetDate, 4) _
            & " " & Mid (dtmTargetDate, 9, 2) & ":" & _
                Mid(dtmTargetDate, 11, 2) & ":" & Mid(dtmTargetDate, _
                    13, 2))
End Function

_____________________________

François Racine
Technicien

Please rate my post :)

Post #: 1

RE: Using Instr in WMI Query - 6/5/2008 1:50:54 AM

mseely

Posts: 39
Score: 1
Joined: 5/4/2008
Status: offline

I don't think that INSTR is available under WMI.

Try changing the query to [Hopefully i have quotes in the right place]:
   ("Select * from Win32_NTLogEvent Where Logfile = 'Application' AND " _
          & "EventCode = '1004' AND message like '%" & strcomputername & "%' and TimeWritten >= '" _
      & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")

(using a 'LIKE' instead of the 'INSTR')

or ....
place the Instr() function within the 'For Each' Loop:

For Each objEvent in colEvents
if InStr(objEvent.Message,strcomputername)>0 then
...
end if
Next

---
Mark

(in reply to fracine)

Post #: 2

RE: Using Instr in WMI Query - 6/5/2008 7:59:24 AM

akaplan

Posts: 172
Score: 21
Joined: 4/22/2003
From: North Carolina
Status: offline

And LIKE is not available in WMI for Windows 2000 systems if you have any in service. The FOR loop may take longer, but will be more reliable in a mixed environment.

Alan

(in reply to mseely)

Post #: 3

RE: Using Instr in WMI Query - 6/29/2008 12:42:02 AM

pcgeek86

Posts: 1
Score: 0
Joined: 6/29/2008
Status: offline

++ I recommend using WMI in a somewhat limited fashion. Use it to get your basic set of data, but use VBscript to filter and work with it.

(in reply to akaplan)

Post #: 4