"Oliver Marshall" wrote:

> Hi,
>
> I have a script that returns the eventlogs that have occurred on a specified
> day. However, i have a need to mod the script so that it returns the logs
> that have occurred within the last 24 hours (this being different to on a
> specified day). ie if it runs at 07:30 monday it should return logs between
> 07:30 sunday and 07:30 monday.
>
> How should I phrase the SQL for this ? Currently I have...
>
> Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
> Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
> DateToCheck = CDate("9/24/2007")
> dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
> dtmEndDate.SetVarDate DateToCheck + 1, CONVERT_TO_LOCAL_TIME
>
> ...
>
> Set colEvents = objWMIService.ExecQuery _
> ("Select * from Win32_NTLogEvent Where Logfile = 'Application' and
> TimeWritten >= '" & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'
> and Type='Error'")
>
> ...
>

You can try setting DateToCheck to Now() and use DateToCheck - 1 (Didn't
test this):

Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
DateToCheck = Now
dtmStartDate.SetVarDate DateToCheck - 1, CONVERT_TO_LOCAL_TIME

Set colEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'Application' and
TimeWritten >= '" & dtmStartDate & "' and Type='Error'")


--
urkec

That would give logs between yesterday morning and now. So if the check
happened at 8pm today, it would return anything from yesterday at 00:01 to
today which is more than 24 hours

Thanks anyway

"urkec" wrote:

> "Oliver Marshall" wrote:
>
> > Hi,
> >
> > I have a script that returns the eventlogs that have occurred on a specified
> > day. However, i have a need to mod the script so that it returns the logs
> > that have occurred within the last 24 hours (this being different to on a
> > specified day). ie if it runs at 07:30 monday it should return logs between
> > 07:30 sunday and 07:30 monday.
> >
> > How should I phrase the SQL for this ? Currently I have...
> >
> > Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
> > Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")
> > DateToCheck = CDate("9/24/2007")
> > dtmStartDate.SetVarDate DateToCheck, CONVERT_TO_LOCAL_TIME
> > dtmEndDate.SetVarDate DateToCheck + 1, CONVERT_TO_LOCAL_TIME
> >
> > ...
> >
> > Set colEvents = objWMIService.ExecQuery _
> > ("Select * from Win32_NTLogEvent Where Logfile = 'Application' and
> > TimeWritten >= '" & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'
> > and Type='Error'")
> >
> > ...
> >
>
> You can try setting DateToCheck to Now() and use DateToCheck - 1 (Didn't
> test this):
>
> Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
> DateToCheck = Now
> dtmStartDate.SetVarDate DateToCheck - 1, CONVERT_TO_LOCAL_TIME
>
> Set colEvents = objWMIService.ExecQuery _
> ("Select * from Win32_NTLogEvent Where Logfile = 'Application' and
> TimeWritten >= '" & dtmStartDate & "' and Type='Error'")
>
>
> --
> urkec

"Oliver Marshall" wrote:

> That would give logs between yesterday morning and now. So if the check
> happened at 8pm today, it would return anything from yesterday at 00:01 to
> today which is more than 24 hours
>
> Thanks anyway
>

I tested this:

Set dtmStartDate = CreateObject ("WbemScripting.SWbemDateTime")
DateToCheck = Now
dtmStartDate.SetVarDate DateToCheck - 1, True
WScript.Echo dtmStartDate

It gave me 20070923220056.000000+120 , which is about 24 hours from now (CET).


--
urkec