Can event consumer cause problems with Event log?

[carlucjr]

Hi,

I have been experimenting with real time event log monitoring. I ran the code below on one computer, then created events on the remote computer to confirm it worked. I was curous as to how the TCP session would be established. Anyway - I broke out of the script (Ctrl-C) and figured that'd be the end of it.

Now I am noticing that my Event ID numbers have all changed! Events are reporting with the wrong Event ID.

I tried rebooting to no avail. Anyone have any idea why this would occur?

Thanks.





strComputer = "remote-computer"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate, (Security)}!\\" & _
strComputer & "\root\cimv2")

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("Select * from __instancecreationevent where " _
& "TargetInstance isa 'Win32_NTLogEvent' " _
& "and TargetInstance.EventCode = '5' ")

Do
Set objLatestEvent = colMonitoredEvents.NextEvent
strAlertToSend = objLatestEvent.TargetInstance.User _
& " The event was triggered."
Wscript.Echo strAlertToSend
Loop