Issue pulling event logs using WMI

[mfc133]

I'm running into an issue using WMI to pull event logs from remote machines and writing them to a SQL dB. It works fine except for events that show up like this in Event Viewer (check out MS KB article 312216):

The description for Event ID ( 504 ) in Source ( CiscoUnity_PHGreeting ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: IAvNamedProps::SetPropBool, 0x80004005, 4477, e:\views\Unity4.0.2.122\un_Conv2\AvConvPhoneHandler\AvConvPHGreetingSvr\AvSPlayGreeting.cpp,

In this case WMI returns a null value for the event message. I understand why it's happening, but I'm wondering if there's any way for WMI to pull out the partial information (The part that starts with IAvNAmedProps in above example) like Event Viewer can.

 

[strebor]

Check out Microsoft Log Parser 2.2. This free application from Microsoft has some very good tools for accessing and extracting log information, including Event Log. You can write a query (SQL-Like syntax) to get the entries you are interested in and output the information to a lot of built-in outputs, including directly into an SQL database.

You can use it from a command line specifying a file that contains your query and telling it where to land the results... or you can used it from an application that you might create in HTA or C# or VB.

http://www.microsoft.com/technet/community/columns/profwin/pw0505.mspx

strebor