System Event Log Reading

I have a need to query the System Event Log and I'm using the following
query.

Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = 'System'")
For Each objEvent in colLoggedEvents
do stuff
Next

Is it safe for me to assume that the log will ALWAYS be read starting from
the most recent event, so when I find the first occurance the
objEvent.EventCode I'm looking for it will ALWAYS be the most recent? If
not, what steps do I have to take to ensure that?

Thanks,

Tom

Dominic
Thu Jul 26 11:02:51 CDT 2007

On 26 Jul, 14:55, "Tom Ker" <thomas.DOT.k...@Thighmark.com> wrote:
> Is it safe for me to assume that the log will ALWAYS be read starting from
> the most recent event, so when I find the first occurance the
> objEvent.EventCode I'm looking for it will ALWAYS be the most recent? If
> not, what steps do I have to take to ensure that?

Tom,

I'm not sure it is safe for you to make that assumption. A while back
I had a similar issue when I was using System Event Log records to
calculate downtime. The order the records were returned in seemed to
be unpredictable.

To get round this I loaded the data into a disconnected recordset and
then sorted by the RecordNumber field. This seemed to be more reliable
than using TimeWritten or TimeGenerated. However, my WMI query was
more specific than yours you're asking for the entire data in the log
file and that could be a lot.

If you aren't already familiar with using a disconnected recordset
there is an example here:

http://www.microsoft.com/technet/scriptcenter/guide/sas_ent_piij.mspx?mfr=true

Dominic

Grand_Poobah
Thu Jul 26 11:26:09 CDT 2007


> I have a need to query the System Event Log and I'm using the following
> query.
>
> Set colLoggedEvents = objWMIService.ExecQuery _
> ("Select * from Win32_NTLogEvent Where Logfile = 'System'")
> For Each objEvent in colLoggedEvents
> do stuff
> Next
>
> Is it safe for me to assume that the log will ALWAYS be read starting from
> the most recent event, so when I find the first occurance the
> objEvent.EventCode I'm looking for it will ALWAYS be the most recent? If
> not, what steps do I have to take to ensure that?
>
> Thanks,
>
> Tom
>
>

I am not sure if you can do this, but would the addition of an "Order By
{whatever}" addition to your query help?

GP