获取最近15分钟登录的EventLog [英] Getting EventLogs which are logged in last 15 minutes

查看：133 发布时间：2019/6/15 9:12:37 scripting

本文介绍了获取最近15分钟登录的EventLog的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我需要一个脚本来获取最近15分钟的事件日志。这是我正在尝试的代码，但我不知道如何获得分钟。请指导我。

I need to have a scripte to get the eventlogs in last 15 minutes. Here is the code which i am trying, But i don't know how to get for the minutes. Please guide me.

选项明确

Option Explicit

Dim objFso，objFolder，objWMIService，objEvent'对象

Dim strFile，strComputer，strFolder，strFileName，strPath'字符串

Dim intEvent，intNumberID，intRecordNum，colLoggedEvents，colEvents

Dim dtmStartDate，dtmEndDate，DateToCheck，CurTime ，CurDate，TimetoCheck

Dim objFso, objFolder, objWMIService, objEvent ' Objects
Dim strFile, strComputer, strFolder, strFileName, strPath ' Strings
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents, colEvents
Dim dtmStartDate, dtmEndDate, DateToCheck, CurTime, CurDate, TimetoCheck

'---------------------------------- ----------

'设置你的变量

intNumberID = 50022'事件ID号码

intEvent = 1

intRecordNum = 1

' --------------------------------------------
' Set your variables
intNumberID = 50022 ' Event ID Number
intEvent = 1
intRecordNum = 1

strComputer ="。"
$
strFileName =" \ Event522.txt"

strFolder =" E：\Scripts"

strPath = strFolder& strFileName

strComputer = "."
strFileName = "\Event50022.txt"
strFolder = "E:\Scripts"
strPath = strFolder & strFileName

设置dtmStartDate = CreateObject（" WbemScripting.SWbemDateTime"）

设置dtmEndDate = CreateObject（ " WbemScripting.SWbemDateTime"）

Set dtmStartDate = CreateObject("WbemScripting.SWbemDateTime")
Set dtmEndDate = CreateObject("WbemScripting.SWbemDateTime")

Const CONVERT_TO_LOCAL_TIME = True

Const wbemCimTypeDatetime = 101

Const CONVERT_TO_LOCAL_TIME = True
Const wbemCimTypeDatetime = 101

TimetoCheck = Now

dtmStartDate.SetVarDate TimetoCheck，CONVERT_TO_LOCAL_TIME

dtmEndDate.SetVarDate TimetoCheck - 15，CONVERT_TO_LOCAL_TIME

dtmStartDate.SetVarDate TimetoCheck, CONVERT_TO_LOCAL_TIME
dtmEndDate.SetVarDate TimetoCheck - 15, CONVERT_TO_LOCAL_TIME

'----------------------------------------

'创建保存文件的文件夹的部分。

设置objFso = CreateObject（" Scripting.FileSystemObject"）

' ----------------------------------------
' Section to create folder to hold file.
Set objFso = CreateObject("Scripting.FileSystemObject")

如果objFSO.FolderExists（strFolder）那么

   设置objFolder = objFSO.GetFolder（strFolder）

否则为
  设置objFolder = objFSO.CreateFolder（strFolder）

   Wscript.Echo" Folder created" &安培; strFolder

结束如果

设置strFile = objFso.CreateTextFile（strPath，True）

If objFSO.FolderExists(strFolder) Then
    Set objFolder = objFSO.GetFolder(strFolder)
Else
   Set objFolder = objFSO.CreateFolder(strFolder)
   Wscript.Echo "Folder created " & strFolder
End If
Set strFile = objFso.CreateTextFile(strPath, True)

'-------- ------------------------------------

'下一节创建文件存储事件

'然后创建WMI连接到日志

'--------------------------------------------
' Next section creates the file to store Events
' Then creates WMI connector to the Logs

设置objWMIService = GetObject（" winmgmts：" _

   &" {impersonationLevel = impersonate}！\\"& strComputer&" \root \ cimv2"）

设置colEvents = objWMIService.ExecQuery _
$
    （" Select * from Win32_NTLogEvent Where Logfile ='Operations Manager'and TimeWritten> ='" _

       & ; dtmStartDate&"'和TimeWritten<'"& dtmEndDate&"'"）

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colEvents = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where Logfile = 'Operations Manager' and TimeWritten >= '" _
        & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'")

' Wscript.Echo"按OK并等待30秒（ish）"

'------------------------------ -----------

'下一节循环通过ID属性

intEvent = 1

对于colLoggedEvents中的每个objEvent

'Wscript.Echo " Press OK and Wait 30 seconds (ish)"
' -----------------------------------------
' Next section loops through ID properties
intEvent = 1
For Each objEvent in colLoggedEvents

'Wscript.Echo objEvent.EventCode

'Wscript.Echo intNumberID

如果objEvent.EventCode = intNumberID然后

If objEvent.EventCode = intNumberID Then

'Wscript.Echo" In"

'Wscript.Echo "In"

strFile.WriteLine（" Record No："）& intEvent

'strFile.WriteLine（" Category："& objEvent.Category）

strFile.WriteLine（" Computer Name：&& amp; ; objEvent.ComputerName）

strFile.WriteLine（" Event Code："& objEvent.EventCode）

strFile.WriteLine（" Message： "& objEvent.Message）

'strFile.WriteLine（" Record Number："& objEvent.RecordNumber）

strFile.WriteLine（ "Source Name："& objEvent.SourceName）

strFile.WriteLine（" Time Written："& objEvent.TimeWritten）

strFile.WriteLine（" Event Type："& objEvent.Type）

strFile.WriteLine（" User："& objEvent.User）

strFile.WriteLine（""）

intRecordNum = intRecordNum +1

结束如果

IntEvent = intEvent +1

下一页

Wscript.Echo" Check" &安培; strPath& "为" & intRecordNum& "事件"

strFile.WriteLine ("Record No: ")& intEvent
' strFile.WriteLine ("Category: " & objEvent.Category)
strFile.WriteLine ("Computer Name: " & objEvent.ComputerName)
strFile.WriteLine ("Event Code: " & objEvent.EventCode)
strFile.WriteLine ("Message: " & objEvent.Message)
' strFile.WriteLine ("Record Number: " & objEvent.RecordNumber)
strFile.WriteLine ("Source Name: " & objEvent.SourceName)
strFile.WriteLine ("Time Written: " & objEvent.TimeWritten)
strFile.WriteLine ("Event Type: " & objEvent.Type)
strFile.WriteLine ("User: " & objEvent.User)
strFile.WriteLine (" ")
intRecordNum = intRecordNum +1
End if
IntEvent = intEvent +1
Next
Wscript.Echo "Check " & strPath & " for " &intRecordNum & " events"

WScript.Quit

获取最近15分钟登录的EventLog [英] Getting EventLogs which are logged in last 15 minutes

问题描述

推荐答案

相关文章

其他开发语言最新文章

热门教程

热门工具

登录关闭

获取最近15分钟登录的EventLog [英] Getting EventLogs which are logged in last 15 minutes

问题描述

推荐答案

相关文章

其他开发语言最新文章

热门教程

热门工具

登录 关闭

登录关闭