Parsing Event Logs in WSH
(Page 1 of 4 )
Event Logs provide a very informative tool for system administrators. They can serve as an early warning system for system failures and can aid greatly in the detection and resolution of existing problems. Today we’re going to explore ways of using WSH to parse that information for better analysis and archival purposes.
To begin, I’m going to demonstrate how to use WMI in conjunction with WSH to read events in the various Win32 event logs. We’re going to read this information into a database. This database could be used as a simple archive, or to sort the data for easier analysis.
I’m going to use Microsoft’s Jet driver simply because it’s very common. You can use any database driver you like. I’m also going to build an MDB (Microsoft Access) database, again because it’s common.
Different database drivers support different levels of functionality. Some even support different properties and methods. If you’re unsure about the one you choose, MSDN is a good place to find that documentation. Chances are good that you can just drop in this code and run with it anyway.
Finally, I’m not going to go into great detail about manipulating this information. I’m assuming that you are either familiar with working with databases or are at least familiar with database management software like Access. My focus in this article series is going to be setting up the database and the strategy behind that.
This project is actually two-fold. While the immediate benefits of moving this information to a database are obvious, there is much more to be had here. Over the course of this article series, I’ll be building upon this base idea to develop a really nice solution for network and system administrators alike.
But I’m not letting the cat out of the bag on that just yet; you’re going to have to come back for the rest of the articles. I promise you’re going to like what I’ve come up with this time.
Put on your coding caps and fill up those coffee cups. Let’s get started!
Next: Using WMI to access NT Log events >>
More Windows Scripting Articles
More By Nilpo/Developer Shed Staff Writer
