Scripting Guide<\/B><\/A>. Suffice to say, however, that a value like 20070905121045.578000-420 isn\u2019t quite as intuitive as information like this:<\/P>9\/5\/2007 12:10 PM\n<\/PRE>\nBut how in the world<\/I> do we convert a UTC value to something a human being can read and understand? Why, like this, of course:<\/P>dtmTimeWritten = CDate(Mid(strTimeWritten, 5, 2) & “\/” & _\n Mid(strTimeWritten, 7, 2) & “\/” & Left(strTimeWritten, 4) _\n & ” ” & Mid (strTimeWritten, 9, 2) & “:” & _\n Mid(strTimeWritten, 11, 2) & “:” & Mid(strTimeWritten, 13, 2))\n<\/PRE>\nAgain, you can find a complete description of what we\u2019re doing in the Scripting Guide. As a quick summary, all we\u2019re really doing here is grabbing the individual pieces of the UTC value and constructing our own date-time value. For example, the first four digits in a UTC value represent the current year; thus 2007<\/B>0905121045.578000-420 indicates that we\u2019re dealing with the year 2007. In turn, that means code like this, which snags the first four characters in our UTC value, also lets us know that we\u2019re dealing with the year 2007:<\/P>Left(strTimeWritten, 4)\n<\/PRE>\nIf you follow the logic of the script all the way through, you\u2019ll see that, eventually, the variable dtmTimeWritten gets assigned a value like this:<\/P>
9\/5\/2007 12:10:45 PM\n<\/PRE>\nNow that\u2019s<\/I> something we can work with.<\/P>\n
As it turns out, the tab-delimited file format used by Event Viewer separates the date (9\/5\/2007) from the time (12:10:45 PM). That\u2019s fine; because of that, we next use the FormatDateTime<\/B> function and the VBScript constants vbShortDate and vbLongTime to store the date in a variable named dtmDate and the time in a variable named dtmTime:
<\/P>dtmDate = FormatDateTime(dtmTimeWritten, vbShortDate)\ndtmTime = FormatDateTime(dtmTimeWritten, vbLongTime)\n<\/PRE>\nOnce we\u2019ve taken care of the date and time, our next step is to begin constructing the first line of the text file (which will correspond to the information in the first event recorded in the event log). That\u2019s what this block of code is for:<\/P>
strEvent = dtmDate & vbTab\nstrEvent = strEvent & dtmTime & vbTab\nstrEvent = strEvent & objEvent.SourceName & vbTab\nstrEvent = strEvent & objEvent.Type & vbTab\nstrEvent = strEvent & objEvent.Category & vbTab\nstrEvent = strEvent & objEvent.EventCode & vbTab\nstrEvent = strEvent & objEvent.User & vbTab\nstrEvent = strEvent & objEvent.ComputerName & vbTab\n<\/PRE>\nAs you can see, there\u2019s nothing too fancy here. In the first line, we assign the date (represented by the variable dtmDate) and a tab character (the VBScript constant vbTab) to a variable named strEvent. (Why a tab character? Because we want each field to be separated by a tab.) In line 2, we assign strEvent the current value of strEvent plus<\/I> the value of the variable dtmTime plus<\/I> another tab character. We then repeat this process several times, tacking the values of WMI properties such as SourceName<\/B> and Type<\/B> to the value of strEvent.<\/P>\n
That brings us to this block of code:<\/P>
strDescription = objEvent.Message\nIf IsNull(strDescription) Then\n strDescription = “The event description cannot be found.”\nEnd If\nstrDescription = Replace(strDescription, vbCrLf, ” “)\nstrEvent = strEvent & strDescription\n<\/PRE>\nPerhaps the most important property of an event log event is the Message<\/B> property; the Message property, as you doubtless know, provides a (more or less) detailed description of the event. Unfortunately, however, the Message property can potentially cause havoc with our script. So what do we do about that<\/I>? That\u2019s easy: we take steps to defuse these problems before they occur.<\/P>\n
What kind of problems are we talking about? Well, for one thing, the Message property often includes one or more carriage return-linefeed characters; in other words, the value of the Message property might look like this:<\/P>
Security policy in the Group policy objects has been applied successfully.<\/p>\nFor more information, see Help and Support Center at http:\/\/go.microsoft.com\/fwlink\/events.asp.\n<\/PRE>\n
What\u2019s wrong with that? Well, in a tab-delimited file, all the information for a single event must fit on one line; that\u2019s not going to be the case if the Message includes a carriage return-linefeed character. Consequently, we use the Replace<\/B> function to replace any carriage return-linefeed characters (vbCrLf) with a blank space:<\/P>strDescription = Replace(strDescription, vbCrLf, ” “)\n<\/PRE>\nThat\u2019s great, but, in turn, this introduces another problem. For some events the Message property doesn\u2019t actually have<\/I> a value. In Event Viewer, that\u2019s no problem; in a case like that, Event Viewer displays a message similar to this:<\/P>The description for Event ID ( 0 ) in Source ( iPod Service ) cannot be found. The local computer may not have the\nnecessary registry information or message DLL files to display messages from a remote computer. You may be \nable to use the \/AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following \ninformation is part of the event: Service started.\n<\/PRE>\nBut that works only in Event Viewer; that information does not<\/I> get passed to the Message property. Instead, the value of the Message property comes back as Null.<\/P>\n
Is that a problem? As a matter of fact, it is; running the Replace function against a Null value is a recipe for disaster. (Assuming, of course, that you consider a script that crashes to be a disaster.) Therefore, before we call the Replace function we execute this block of code:<\/P>
If IsNull(strDescription) Then\n strDescription = “The event description cannot be found.”\nEnd If\n<\/PRE>\nAll we\u2019re doing here is using the IsNull<\/B> function to determine whether the Message property (which is stored in the variable strDescription) happens to be Null. If it\u2019s not, well, no problem. If it is<\/I>, then we simply set the value of strDescription to the generic message \u201cThe event description cannot be found.\u201d<\/P>\n
After dealing with any potential Null values, we call the Replace function, then tack the value of strDescription onto the end of our event string:<\/P>
strEvent = strEvent & strDescription\n<\/PRE>\nAnd then we simply call the WriteLine<\/B> method to write this event to the text file:<\/P>objFile.WriteLine strEvent\n<\/PRE>\nFrom there we zip back to the top of our For Each loop and repeat the process with the next event in the collection. After we\u2019ve added all the events to the text file we execute the Close<\/B> method, close the file, and call it a day.<\/P>\n
We hope that answers your question, IMBDS. If it doesn\u2019t, don\u2019t bother to send us an email; instead, just give us a call. After all \u2013 sigh \u2013 that\u2019s what everyone else does. Oops; gotta go. The phone\u2019s ringing.<\/P>\n
\n<\/THEAD>\n\n\n| \n Note<\/B>. In the true spirit of entrepreneurship, there are companies that will actually call you, on the phone, and (for a small fee) offer to put your phone number on the Do Not Call registry. Only in America \u2026.<\/P><\/TD><\/TR><\/TBODY><\/TABLE><\/p>\n","protected":false},"excerpt":{"rendered":" Hey, Scripting Guy! How can I backup an event log to a text file?— IMBDS Hey, IMBDS. You know, the Scripting Guys have dedicated their lives to helping others. (Well, OK, originally we dedicated our lives to having others help us. But when no one seemed very interested in that we changed our minds.) That […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[343,97,98,3,4,14,5],"class_list":["post-64073","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-backup","tag-event-logs","tag-logs-and-monitoring","tag-scripting-guy","tag-scripting-techniques","tag-text-files","tag-vbscript"],"acf":[],"blog_post_summary":" Hey, Scripting Guy! How can I backup an event log to a text file?— IMBDS Hey, IMBDS. You know, the Scripting Guys have dedicated their lives to helping others. (Well, OK, originally we dedicated our lives to having others help us. But when no one seemed very interested in that we changed our minds.) That […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/64073","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=64073"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/64073\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=64073"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=64073"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=64073"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} |
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/q-for-powertip.jpg\" "\\"Hey,")
\n![\"Spacer\"](\"https:\/\/devblogs.microsoft.com\/scripting\/wp-content\/uploads\/sites\/29\/2019\/05\/spacer.gif\")
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/a-for-powertip.jpg\" "\\"Hey,")
![\"Script](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/ad.jpg\" "\\"Script")
<\/A> \n