Hi - Does anyone know why the EventIdentifier number in WMI doesn't match the Event ID in the Windows Event Log? I'm using WMI CIM Studio to query the WMI db to look at events that show up in the Windows Event Viewer but aren't showing up in my log management system ( which uses WMI). The events that aren't being captured have huge numbers in WMI that are different than the numbers in the Windows event log, which is why the log management system doesn't collect them. It expects the Windows Event ID number. For example, Event Id 5000 (Source:McLogEvent) shows up in WMI as ID 1073746824.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
wmi
- Thread starter cindylee
- Start date
You're looking at the wrong attribute. Look at EventCode which is found in the Win32_NTLogEvent class.
PSC
Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers
PSC
Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers
- Thread starter
- #3
- Status
Similar threads
- Locked
- Question