Reading an .evt in vb script

[alliseeing]

Still learning vb.

Trying to read single .evt that is local or in a folder to the script location.

Like this, but I want to designate the path it pulls from

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = ''Application''")
For Each objEvent in colLoggedEvents
Wscript.Echo "Category: " & objEvent.Category
Wscript.Echo "Computer Name: " & objEvent.ComputerName
Wscript.Echo "Event Code: " & objEvent.EventCode
Wscript.Echo "Message: " & objEvent.Message
Wscript.Echo "Record Number: " & objEvent.RecordNumber
Wscript.Echo "Source Name: " & objEvent.SourceName
Wscript.Echo "Time Written: " & objEvent.TimeWritten
Wscript.Echo "Event Type: " & objEvent.Type
Wscript.Echo "User: " & objEvent.User
Next

Any help would be appreciated

 

[alliseeing]

Making more clearer, i am trying to retrieved .evt files from an archived folder on the computer say 'c:\archived_logs' that contain nothing but .evt files. How would I modify the code below to facilitate this.

If bAllLogs Then
Set cLogFiles = oWMI.ExecQuery("SELECT LogFileName FROM Win32_NTEventLogFile")
sLogName = ""
For Each oLog In cLogFiles
sLogName = sLogName & oLog.LogFileName & "," 'Some log names contain spaces.
Next
Set cLogFiles = Nothing
End If

 

[PHV]

Have a look here:

http://www.microsoft.com/downloads/...6b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en

Hope This Helps, PH.
FAQ219-2884
FAQ181-2886

 

[alliseeing]

I already have a working script not using log parser. I can already pull the evt files. just wanna pull from a different directory on the system. See

code

If bAllLogs Then
Set cLogFiles = oWMI.ExecQuery("SELECT LogFileName FROM Win32_NTEventLogFile")
sLogName = ""
For Each oLog In cLogFiles
sLogName = sLogName & oLog.LogFileName & "," 'Some log names contain spaces.
Next
Set cLogFiles = Nothing
End If

/code

just wanna change the directory(directory of whats being queried). Trying to figure what win32 api call i can use.

Thanks for you input

 

[PHV]

Something like this ?

Set cLogFiles = oWMI.ExecQuery("SELECT LogFileName FROM Win32_NTEventLogFile WHERE Path='\windows\system\'")

Hope This Helps, PH.
FAQ219-2884
FAQ181-2886

 

[alliseeing]

I will try later ...gotta go work ....Thx

 

[alliseeing]

Thanks that work for me man. Sometimes the answer is so simple

Thanks again.