Win32_NTLogEvent and Performance

I'm trying to help out a customer. The simple script below runs very quickly
on a local system however on a remote production server it takes upwards of
40 minutes! Any ideas?

Set colLogFiles = objWMIService.ExecQuery( "SELECT LogfileName FROM
Win32_NTEventlogFile" )
For Each objLogFile in colLogFiles

'Find all the event log entries in that log.
Set colEvents = objWMIService.ExecQuery( "SELECT * FROM Win32_NTLogEvent
WHERE Logfile = '" & objLogFile.LogFileName & _
"' AND TimeGenerated > '" & strThen & "'" )
count = 0
For Each objEvent in colEvents

' Display some information about the event log entry and stop processing
the rest of them.
Wscript.Echo " " & objLogFile.LogFileName & ": Event ID: " &
objEvent.EventCode & "; Time: " & objEvent.TimeGenerated
count = count + 1
If count >= 10 Then
Exit For
End If

Next

Next

/\\/\\o\\/\\/
Thu Mar 16 15:49:59 CST 2006

try to leave out the big array properties as insertionstrings
this will help a lot, also check your memory usage, if you realy need
all the info as this also takes a lot of memory so upgrading your memory
could help, but if you get the Time, Type, Source, EventID, Message you
mostly have enough.

gr /\/\o\/\/


momguy wrote:
> I'm trying to help out a customer. The simple script below runs very quickly
> on a local system however on a remote production server it takes upwards of
> 40 minutes! Any ideas?
>
> Set colLogFiles = objWMIService.ExecQuery( "SELECT LogfileName FROM
> Win32_NTEventlogFile" )
> For Each objLogFile in colLogFiles
>
> 'Find all the event log entries in that log.
> Set colEvents = objWMIService.ExecQuery( "SELECT * FROM Win32_NTLogEvent
> WHERE Logfile = '" & objLogFile.LogFileName & _
> "' AND TimeGenerated > '" & strThen & "'" )
> count = 0
> For Each objEvent in colEvents
>
> ' Display some information about the event log entry and stop processing
> the rest of them.
> Wscript.Echo " " & objLogFile.LogFileName & ": Event ID: " &
> objEvent.EventCode & "; Time: " & objEvent.TimeGenerated
> count = count + 1
> If count >= 10 Then
> Exit For
> End If
>
> Next
>
> Next
>

/\\/\\o\\/\\/
Thu Mar 16 16:04:36 CST 2006

on closer look you only use this ones.
so you should only get those in your query

so the WMI query could be : (

Set colEvents = objWMIService.ExecQuery( SELECT
LogFileName,EventCode,TimeGenerated FROM Win32_NTLogEvent WHERE Logfile
= '" & objLogFile.LogFileName & _
"' AND TimeGenerated > '" & strThen & "'" )

also I use some wrong names, this are the available names :

Category
CategoryString
ComputerName
Data
EventCode
EventIdentifier
EventType
InsertionStrings
Logfile
Message

also data should be avoided


/\/\o\/\/ wrote:
> try to leave out the big array properties as insertionstrings
> this will help a lot, also check your memory usage, if you realy need
> all the info as this also takes a lot of memory so upgrading your memory
> could help, but if you get the Time, Type, Source, EventID, Message you
> mostly have enough.
>
> gr /\/\o\/\/
>
>
> momguy wrote:
>> I'm trying to help out a customer. The simple script below runs very
>> quickly on a local system however on a remote production server it
>> takes upwards of 40 minutes! Any ideas?
>>
>> Set colLogFiles = objWMIService.ExecQuery( "SELECT LogfileName FROM
>> Win32_NTEventlogFile" )
>> For Each objLogFile in colLogFiles
>>
>> 'Find all the event log entries in that log.
>> Set colEvents = objWMIService.ExecQuery( "SELECT * FROM
>> Win32_NTLogEvent WHERE Logfile = '" & objLogFile.LogFileName & _
>> "' AND TimeGenerated > '" & strThen & "'" )
>> count = 0
>> For Each objEvent in colEvents
>>
>> ' Display some information about the event log entry and stop
>> processing the rest of them.
>> Wscript.Echo " " & objLogFile.LogFileName & ": Event ID: "
>> & objEvent.EventCode & "; Time: " & objEvent.TimeGenerated
>> count = count + 1
>> If count >= 10 Then
>> Exit For
>> End If
>>
>> Next
>>
>> Next
>>