problem using datetime variables in WMI queries.

[ericwood]

Here's what I'm trying to do. I want to check my eventlog for when a specific event happened and then I want to get every event after that time.

The code to get the date of the specific event looks like this:

	Set objWMIService = GetObject("winmgmts:" _
	    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
	
	if err.number <> 0 then
		on error goto 0
		wscript.echo "	ERROR"
		LastReboot = -1
		err.Clear
	else
		on error goto 0
		wscript.echo "	NO ERROR"
		set colEvents = objWMIService.ExecQuery("select TimeWritten from Win32_NTLogEvent where Logfile = 'System' and SourceName = 'EventLog' and EventCode = '6009'")
		For Each objEvent in colEvents	
			LastReboot = objEvent.TimeWritten
		exit for
		Next
	end if

and it returns a result that looks like 20080223075539.000000-300 which seems like a valid response. However if I plug that into code that looks like this:

	Set objWMIService = GetObject("winmgmts:" _
	    & "{impersonationLevel=impersonate}!\\" & strComputername & "\root\cimv2")
	Set colEvents = objWMIService.ExecQuery ("Select * from Win32_NTLogEvent Where TimeWritten >= '" & dateDate)

I don't get any results. Now I'm pretty sure the problem has something to do with variant subtype casting but I don't know what to do about it. I've tried using cdate and I've tried using something like

Set dtmLastReboot = CreateObject("WbemScripting.SWbemDateTime")
dtmLastReboot.setvardate objEvent.TimeWritten

to force it to be a datetime but I keep getting a Type Mismatch error even though the TimeWritten property is a datetime variant in the Win32_NTLogEvent.

So I'm really frustrated by working with time and working with uncast variants so I'm hoping somebody has a suggestion.

Thansk in advance for any help.

 

[tsuji]

[tt][green]'your input
dateDate=#2008/3/31#[/green]

[blue]set oswbemdtm=createobject("wbemscripting.swbemdatetime")
oswbemdtm.setvardate dateDate,true 'CONVERT_TO_LOCAL_TIME=true[/blue]

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputername & "\root\cimv2")
Set colEvents = objWMIService.ExecQuery ("Select * from Win32_NTLogEvent Where [blue]TimeWritten >= " & oswbemdtm[/blue])
[/tt]