Need help with WMI SQL syntax.

I am trying to search multiple machine's Event log for several events.
I'm trying to do it in one pass, and I think I'm close.
This query does not return any data when run against a machine with known
events.
Can anyone give me a hand?

Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where " _
& "(Logfile = 'System' and EventCode =
'1054')"_
& "Or (Logfile = 'System' and EventCode = '1000')" _
& "Or (Logfile = 'System' and EventCode = '1030')" _
& "Or (Logfile = 'System' and EventCode = '1085')" _
& "Or (Logfile = 'System' and EventCode = '5')")

Richard
Thu Mar 06 13:06:02 CST 2008

MartyBorg wrote:

BF640C1EA80E@microsoft.com...
>I am trying to search multiple machine's Event log for several events.
> I'm trying to do it in one pass, and I think I'm close.
> This query does not return any data when run against a machine with known
> events.
> Can anyone give me a hand?
>
> Set colLoggedEvents = objWMIService.ExecQuery _
> ("Select * from Win32_NTLogEvent Where " _
> & "(Logfile = 'System' and EventCode =
> '1054')"_
> & "Or (Logfile = 'System' and EventCode = '1000')" _
> & "Or (Logfile = 'System' and EventCode = '1030')" _
> & "Or (Logfile = 'System' and EventCode = '1085')" _
> & "Or (Logfile = 'System' and EventCode = '5')")
>

It will probably work if you add a space character before each "Or"
operator. At present there is no space after the closing ")" and the "Or".
Alternatively, I would try:

Set colLoggedEvents = objWMIService.ExecQuery _
("SELECT * FROM Win32_NTLogEvent " _
& "WHERE Logfile = 'System' AND " _
& "(EventCode = '1000' OR EventCode = '1030' " _
& "OR EventCode = '1085' OR EventCode = '5')")

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--