dayley replied on Wed, Aug 12 2009 4:09 PM

Workaround example (not optimized):

Option Explicit
const INVALID_PARAMS = 1, SUCCESS = 0, FAIL = 1
Dim oColEvents, oSvc, lst_args
Dim strComputer, strEventArea , strEventID,strEventType, intEventID, strEventSource, strLoggedByUser, strTimeSpanMins, strFindExclusionText, strFindMatchText, strSQL, strSuffix
Dim arg_count, Item, count_unmatch

strSQL               = "Select * from Win32_NTLogEvent "
strComputer          = "localhost"
strEventArea         = ""
strEventType         = ""
intEventID           = 0
strEventSource       = ""
strLoggedByUser      = ""
strFindExclusionText = ""
count_unmatch        = 0

' Converts a date to UTC format: <Year><Month><Day><Hour><Minutes><Seconds>.<milliseconds><time zone offset>
Function ConvertDateToUTC(dte)
     Dim strDateNow, oComp, oColTime, LocalTimeZone, TimeZoneOffset

     Set oComp = GetObject("winmgmts:" & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer & "\root\cimv2")

     Set oColTime = oComp.ExecQuery("SELECT * FROM Win32_ComputerSystem")

     'Get the machine's current time zone offset
     'Use Win32_ComputerSystem CurrentTimeZone property, because it automatically adjusts the
     'Time Zone bias for daylight saving time Win32_Time Zone Bias property does not.
     For Each LocalTimeZone In oColTime
      TimeZoneOffset = LocalTimeZone.CurrentTimeZone
     Next

     strDateNow = Year(dte) & FormatArgs(Month(dte)) & FormatArgs(Day(dte))
     strDateNow = strDateNow & FormatArgs(Hour(dte)) & FormatArgs(Minute(dte)) 
     strDateNow = strDateNow & FormatArgs(Second(dte)) & ".000000" & TimeZoneOffset
     'WScript.Echo strDateNow
     ConvertDateToUTC = strDateNow
End Function

' Makes single digit month and day
Function FormatArgs(str)
   if Len(str) < 2 Then str = "0" & str
   FormatArgs = str
   If not IsNumeric(str) Then
 WScript.Echo "Message: FormatArgs::Invalid arguments"
 Usage
   End If
End Function

 
Set lst_args = WScript.Arguments

If lst_args.Count >0 Then
Else
   WScript.Echo "Message: Usage: wscript.exe WinEventLog.vbs ComputerName " & vbCRLF _
   & "-computer The computer name "  & vbCRLF _
   & "-area Name of Windows NT event log file. Together with RecordNumber, this is used to uniquely identify an instance of this class: Application, Security, System and etc." & vbCRLF _
   & "-type The Event Type: Error, Warning, Information, Success, Failure." & vbCRLF _
   & "-id Identifier of the event. This is specific to the source that generated the event log entry and is used, together with SourceName, to uniquely identify a Windows NT event type." & vbCRLF _
   & "-source Name of the source (application, service, driver, or subsystem) that generated the entry. It is used, together with EventIdentifier to uniquely identify a Windows NT event type" & vbCRLF _
   & "-exclusion Exclusions by Event Text" & vbCRLF _
   & "-match Content Matching Event Text" & vbCRLF _
   & "-timespan How many minutes old can the event be" & vbCRLF
   WScript.Echo "Statistic: 0"
   WScript.Quit( FAIL )
End If

For arg_count = 0 to lst_args.Length - 1
 If lst_args(arg_count) = "-area" Then
     strEventArea = lst_args(arg_count + 1)
     if count_unmatch then
       strSuffix = " AND"
     else
       strSuffix = "Where "
     end if
     strSQL = strSQL + strSuffix + " Logfile = '" + strEventArea + "'"
     arg_count = arg_count + 1
     count_unmatch = count_unmatch + 1
 ElseIf lst_args(arg_count) = "-computer" Then
    strComputer = lst_args(arg_count + 1)
     arg_count = arg_count + 1
 ElseIf lst_args(arg_count) = "-type" Then
    strEventType = lst_args(arg_count + 1)
     if count_unmatch then
       strSuffix = " AND"
     else
       strSuffix = "Where "
     end if
     strSQL = strSQL + strSuffix + " Type = '" + strEventType + "'"
     count_unmatch = count_unmatch +1
  ElseIf lst_args(arg_count) = "-id" Then
    strEventID = lst_args(arg_count + 1)
    intEventID = CInt( strEventID )
   
     if count_unmatch then
       strSuffix = " AND"
     else
       strSuffix = "Where "
     end if
     strSQL = strSQL + strSuffix + " EventCode = '" + strEventID + "'"
     arg_count = arg_count + 1
     count_unmatch = count_unmatch + 1
  ElseIf lst_args(arg_count) = "-source" Then
    strEventSource = lst_args(arg_count + 1)
     if count_unmatch then
       strSuffix = " AND"
     else
       strSuffix = "Where "
     end if
     strSQL = strSQL + strSuffix + " SourceName = '" + strEventSource + "'"
     arg_count = arg_count + 1
     count_unmatch = count_unmatch + 1
  ElseIf lst_args(arg_count) = "-user" Then
    strLoggedByUser = lst_args(arg_count + 1)
     if count_unmatch then
       strSuffix = " AND"
     else
       strSuffix = "Where "
     end if
     strSQL = strSQL + strSuffix + " User = '" + strLoggedByUser + "'"
     arg_count = arg_count + 1
     count_unmatch = count_unmatch +1
   ElseIf lst_args(arg_count) = "-timespan" Then
    strTimeSpanMins = lst_args(arg_count + 1)
     if count_unmatch then
       strSuffix = " AND"
     else
       strSuffix = "Where "
     end if
    dim  dNowStamp,dEndStamp, dToEndTime
    'Set dNowStamp = CreateObject("WbemScripting.SWbemDateTime")
    'Set dEndStamp = CreateObject("WbemScripting.SWbemDateTime")

    'dToEndTime = Now - 0.0416666666   '0.0416666666 represent 1hour; 1/24 of a day
    dToEndTime = Now - strTimeSpanMins / 1440

    'dNowStamp.SetVarDate Now, True
           dNowStamp = ConvertDateToUTC(Now)

    'dEndStamp.SetVarDate dToEndTime, True
           dEndStamp = ConvertDateToUTC(dToEndTime)
   
     strSQL = strSQL + strSuffix + " TimeWritten < '" & dNowStamp  & "' and TimeWritten >= '" & dEndStamp & "'"
    'WScript.Echo strSQL

     arg_count = arg_count + 1
     count_unmatch = count_unmatch +1
  ElseIf lst_args(arg_count) = "-exclusion" Then
    strFindExclusionText = lst_args(arg_count + 1)
     if count_unmatch then
       strSuffix = " AND"
     else
       strSuffix = "Where "
     end if
     strSQL = strSQL + strSuffix + " NOT Message LIKE '%" + strFindExclusionText + "%'"
     arg_count = arg_count + 1
     count_unmatch = count_unmatch +1
  ElseIf lst_args(arg_count) = "-match" Then
    strFindMatchText = lst_args(arg_count + 1)
     if count_unmatch then
       strSuffix = " AND"
     else
       strSuffix = "Where "
     end if
     strSQL = strSQL + strSuffix + " Message LIKE '%" + strFindMatchText + "%'"
     arg_count = arg_count + 1
     count_unmatch = count_unmatch +1
  End If
Next

Set oSvc = GetObject("winmgmts:" & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer & "\root\cimv2")

Set oColEvents = oSvc.ExecQuery(strSQL)

For Each Item In oColEvents
    WScript.Echo "Message: EventType " & Item.EventType & " Event ID " & Item.EventCode & " Source Event  " & Item.SourceName & vbCRLF  & Item.Message
Next

if oColEvents.Count > 0 Then
  WScript.Echo "Statistic: " & CStr(oColEvents.Count)
  WScript.Quit(SUCCESS)
end if

WScript.Echo "Message: No events Found"
WScript.Echo "Statistic: 0"
WScript.Quit(SUCCESS)