Roy,

Pretty slick!  By the way, you know that MAPI is a goner in 2005?

One more thing: Isn't it possible to filter also on the DATE in the query?

btw: Very nice script!

Good article. Just proves there is more than one way to skin a cat

"I cannot find Win32_NTLogEvent anywhere"
This is a WMI class. There is a whole bunch of them in Windows http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/wmi_reference.asp

"...you know that MAPI is a goner in 2005"
Well it's not actually gone, it's still there but you have the option of using a new thing called DatabaseMail which is SMTP based. Realistically, I don't know that many DBA's given the option would use SQL Mail and rely on MAPI and Exchange.

If you go to command prompt and type in wbemtest and enter.

Hit connect.

Change the location from:

root\default to root\cimv2 and hit login

Hit enumerate classes, use recursive radio button, hit ok

You will no have a list of all the classes and their properties.  You can scroll down to Win_NTLogEvent to see the properties in the middle window.

Or you can cut and paste this script as ClassInfo.vbs

Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20

On Error Resume Next

arrComputers = Array(".")

For Each strComputer In arrComputers
   WScript.Echo
   WScript.Echo "=========================================="
   WScript.Echo "Computer: " & strComputer
   WScript.Echo "=========================================="
  
strClass = "Win32_NTEventLog"
Get objWMIService = _
   GetObject("winmgmts:{impersonationLevel=impersonate}root\cimv2")

Set colClasses = objWMIService.ExecQuery("SELECT * FROM " & strClass, "WQL", _
                                          wbemFlagReturnImmediately + wbemFlagForwardOnly)

i = 0
For Each objClass In colClasses
   i = i + 1
   If i = 1 Then
   WScript.Echo "* Properties *"
   For Each objProperty In objClass.Properties_
      WScript.Echo objProperty.Name
   Next

   WScript.Echo vbNewLine & "* Methods *"
   For Each objMethod In objClass.Methods_
      WScript.Echo objMethod.Name
   Next
   End If
Next

Next

Hope this helps

Sorry the line strClass = "Win32_NTEventLog"

Should read:

strClass = "Win32_NTLogEvent"

No http - no go.

You could redirect the output to open an instance of word, excel, etc., then use this accross the lan but there are some issues with this especially with XP, SP2.  I will consider this for a future article. 

I get this error when I try and run the script.  Any thoughts.

[Microsoft][ODBC SQL Server Driver]COUNT field incorrect or syntax error