Microsoft® Windows® 2000 Scripting Guide
« Previous | Next »
WMI provides a way to programmatically access the records in an event log. Although this is an extremely useful capability, WMI does have at least two limitations when it comes to querying large data sources such as event logs:
For example, you might want to tally frequency statistics for the events in an event log. (This would tell you that Event ID 1 has occurred X number of times, Event ID 2 has occurred Y number of times, and so forth.) This type of query can be constructed in SQL by using code similar to the following (assuming you have a database named EventLog):
SELECT Count(EventID) AS CountOfEventID, EventID FROM EventLog GROUP BY CountOfEventID
However, this kind of query cannot be constructed using WQL.
A query against an event log with a large number of records can take a long time to complete. On a Windows 2000 based test computer with an event log containing 12,000 records, a query that returned events with a specific Event ID required 48 seconds to complete. The same query run against an SQL database holding the exact same information completed in less than 1 second.
To carry out a regular and detailed analysis of your event logs, you might want to periodically extract the records from the event log and copy them to a database. Copying the records to a database enables you to create more sophisticated queries and greatly decreases the time it takes to run these queries.
Copying records to a database also allows you to combine the event logs from multiple computers. For example, you might combine all the DNS event logs from all your DNS servers into a single database. Using that database, you can easily construct queries that compare the events that occur on one DNS server with the events that occur on your other DNS servers.
You can periodically copy all the events from an event log to a database, clear the event log, and allow events to accumulate until you copy the events and clear the log again.
Listing 12.12 contains a script that retrieves all the events from an event log and copies them to a database. Before you create this script, you need to create the following:
For information about accessing databases by using scripts, see "Creating Enterprise Scripts" in this book.
To carry out this task, the script must perform the following steps:
This query returns a collection consisting of all the events from all the event logs, except the Security event log.
The appropriate fields in the new record are then populated using the properties of the event record.
Listing 12.12 Copying Events to a Database
|
|
Send us your feedback | « Previous | Next » |