PHactotum Wheneverly: December 2008 Archives

I've been working on code to figure out how many days of events are in an each event log on a given system. I started out by using two articles from Microsoft's Hey, Scripting Guy!:

How Can I Find the Date of the Oldest Event in an Event Log?

How Can I Retrieve Information About the Latest Event Added to an Event Log?

The Oldest Event seemed to work:

strComputer = "."    
Set objWMIService = GetObject("winmgmts:{(Security)}\\" & strComputer & "\root\cimv2")
    
  
    
Wscript.Echo "System"
    
Set colEvents = objWMIService.ExecQuery _
    
    ("Select * from Win32_NTLogEvent Where Logfile = 'System' " & _
    
        "AND RecordNumber = 1")
    
  
    
For Each objEvent in colEvents
    
    Wscript.Echo "Time Written: " & objEvent.TimeWritten
    
Next

This seems to work. I duplicated lines 4 through 11, for the event logs Application and Security, all seemed okay. (Yeah I know redundant code, but sometimes it is just easiest.)

System
Time Written: 20081125044952.000000-300
Security
Time Written: 20081125044947.000000-300
Application
Time Written: 20081125045015.000000-300

All of this testing was on Windows XP SP3. I then tried it on Windows 2003 SP2:

C:\data2>cscript EventLogOldest.vbs
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

System

Security

Application

Hmm, what's going on here. Well, via another script, I figured out that the first event log record isn't always 1. Well it is, but the oldest event log entry in a given log isn't always record 1. See, as a system runs, it will remove old entries as the event log fills up. Thus the oldest record number slowly increments as the old records fall off and new records are added.

The following script, iterates through each event record on a server. It Looks at the record number and log file name and records the oldest and newest record for each log file. It then dumps out the desired information.

'EventLogRecNumbers.vbs    
strComputer = "."
    
Dim HighEvent
    
Dim LowEvent
    
Dim HighEventDate
    
Dim LowEventDate
    
Set HighEvent = CreateObject("Scripting.Dictionary")
    
Set LowEvent = CreateObject("Scripting.Dictionary")
    
Set HighEventDate = CreateObject("Scripting.Dictionary")
    
Set LowEventDate = CreateObject("Scripting.Dictionary")
    
' Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
    
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate,(Security)}\\" & strComputer & "\root\cimv2")
    
Set colItems = objWMIService.ExecQuery( _
    
    "SELECT * FROM Win32_NTLogEvent ",,48)
    
  
    
For Each objItem in colItems
    
    currlogfile = objItem.Logfile
    
    currlogrecord = clng(objItem.RecordNumber)
    
    If not HighEvent.Exists(currlogfile) then
    
        HighEvent.Add currlogfile, currlogrecord
    
        HighEventDate.Add currlogfile,objItem.TimeWritten
    
    else if currlogrecord > HighEvent.item(currlogfile) then
    
            HighEvent.Item(currlogfile) = currlogrecord
    
            HighEventDate.Item(currlogfile) = objItem.TimeWritten
    
        End If
    
    End If
    
    If not LowEvent.Exists(currlogfile) then
    
        LowEvent.Add currlogfile, currlogrecord
    
        LowEventDate.Add currlogfile,objItem.TimeWritten
    
    else if currlogrecord < LowEvent.item(currlogfile) then
    
            LowEvent.Item(currlogfile) = currlogrecord
    
            LowEventDate.Item(currlogfile) = objItem.TimeWritten
    
        End If
    
    End If
    
Next
    
  
    
For Each ELog in HighEvent.Keys
    
    Wscript.Echo "EventLog: " & ELog
    
    Wscript.Echo "     High Record: " & HighEvent.Item(ELog)
    
    Wscript.Echo "     Low Record:  " & LowEvent.Item(ELog)
    
    Wscript.Echo "     Newest Date: " & WMIDateStringToDate(HighEventDate.Item(ELog))
    
    Wscript.Echo "     Oldest Date: " & WMIDateStringToDate(LowEventDate.Item(ELog))
    
    Wscript.Echo "     Days:        " & DateDiff("d",WMIDateStringToDate(LowEventDate.Item(ELog)),WMIDateStringToDate(HighEventDate.Item(ELog)))
    
Next
    
  
    
Function WMIDateStringToDate(dtmInstallDate)
    
    WMIDateStringToDate = CDate(Mid(dtmInstallDate, 5, 2) & "/" & _
    
        Mid(dtmInstallDate, 7, 2) & "/" & Left(dtmInstallDate, 4) _
    
            & " " & Mid (dtmInstallDate, 9, 2) & ":" & _
    
                Mid(dtmInstallDate, 11, 2) & ":" & Mid(dtmInstallDate, _
    
                    13, 2))
    
End Function

This works both on my fairly new XP SP3 system, as well as a Windows 2003 SP2 system. The draw back, is that because the script iterates through every event entry in the logs, it takes a while to come up with the answer. It isn't the most efficient, and I welcome alternative ways of performing this tasks. A plus is that it shows all event logs, not just the common Application, System and Security.

EventLog: Application
High Record: 1232635
Low Record: 1210462
Newest Date: 12/19/2008 11:24:04 PM
Oldest Date: 12/11/2008 10:02:05 PM
Days: 8
EventLog: Directory Service
High Record: 8142
Low Record: 5336
Newest Date: 12/19/2008 1:51:13 PM
Oldest Date: 2/23/2007 3:15:56 AM
Days: 665
EventLog: DNS Server
High Record: 486
Low Record: 1
Newest Date: 11/10/2008 1:37:02 PM
Oldest Date: 1/18/2004 5:50:52 PM
Days: 1758
EventLog: File Replication Service
High Record: 334
Low Record: 1
Newest Date: 11/10/2008 1:37:41 PM
Oldest Date: 1/18/2004 5:30:46 PM
Days: 1758
EventLog: Security
High Record: 22647817
Low Record: 22455586
Newest Date: 12/19/2008 11:25:49 PM
Oldest Date: 11/27/2008 7:04:18 AM
Days: 22
EventLog: System
High Record: 203041
Low Record: 92196
Newest Date: 12/19/2008 11:23:49 PM
Oldest Date: 10/10/2006 5:28:22 AM
Days: 801

PHactotum Wheneverly

December 2008 Archives

December 16, 2008

Robin Williams on the Election

December 20, 2008

Number of days of events in Windows Event Logs

Search

About December 2008