Collecting Event Logs Question

[Nunos]

I have been trying to get a script that I can use to collect events from the EventLog's in windows based on their EventIdentifier. I am using a script that I generated with the AutoIT Scriptomatic tool I found in the examples forum. So far with some help I have figured out how to modify it to search for just the specific event I want and then write that to a text file. Not pretty or ideal but I am hoping someone can point me down another rabbit hole so I can make it better. First off the wmi query gets all of the events for a specific one, while great , it would be better to only have one instance written to the text file so I am wondering how you guys filter down to get just one event instead of say 200. Next I was wondering if the returned data could possibly be written to a gui window that has a scroll bar to fit it all with like a Next button and a Close button? I am not sure how I would get the data from the text file into it or how it even look so if this seems like a bad idea let me know. I will post what I have below if you see things that could be done better please advise and give me a direction to go learn. AutoIT is my first and only scripting knowledge so I am not great at it but I would like to learn how to do things properly. Thank you in advance for your time and comments.

expandcollapse popup

$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$colItems = ""
$strComputer = "localhost"

Local $sLogFile = @ScriptDir & "\EventLog_" & ".txt"
Local $file = FileOpen("EventLog.txt", 1)

; Check if file opened for writing OK
If $file = -1 Then
MsgBox(0, "Error", "Unable to open file.")
Exit
EndIf

$Output=""
$Output &= "Computer: " & $strComputer & @CRLF
$Output &= "==========================================" & @CRLF
$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\")
$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE EventIdentifier = 1073742825", "WQL", _
$wbemFlagReturnImmediately + $wbemFlagForwardOnly)

If IsObj($colItems) then
For $objItem In $colItems
$Output &= "Category: " & $objItem.Category & @CRLF
$Output &= "CategoryString: " & $objItem.CategoryString & @CRLF
$Output &= "ComputerName: " & $objItem.ComputerName & @CRLF
$strData = $objItem.Data(0)
$Output &= "Data: " & $strData & @CRLF
$Output &= "EventCode: " & $objItem.EventCode & @CRLF
$Output &= "EventIdentifier: " & $objItem.EventIdentifier & @CRLF
$Output &= "EventType: " & $objItem.EventType & @CRLF
$strInsertionStrings = $objItem.InsertionStrings(0)
$Output &= "InsertionStrings: " & $strInsertionStrings & @CRLF
$Output &= "Logfile: " & $objItem.Logfile & @CRLF
$Output &= "Message: " & $objItem.Message & @CRLF
$Output &= "RecordNumber: " & $objItem.RecordNumber & @CRLF
$Output &= "SourceName: " & $objItem.SourceName & @CRLF
$Output &= "TimeGenerated: " & WMIDateStringToDate($objItem.TimeGenerated) & @CRLF
$Output &= "TimeWritten: " & WMIDateStringToDate($objItem.TimeWritten) & @CRLF
$Output &= "Type: " & $objItem.Type & @CRLF
$Output &= "User: " & $objItem.User & @CRLF
if FileWrite($file,$Output) = 2 then ExitLoop
$Output=""
Next
Else
Msgbox(0,"WMI Output","No WMI Objects Found for class: " & "Win32_NTLogEvent" )
Endif


Func WMIDateStringToDate($dtmDate)

Return (StringMid($dtmDate, 5, 2) & "/" & _
StringMid($dtmDate, 7, 2) & "/" & StringLeft($dtmDate, 4) _
& " " & StringMid($dtmDate, 9, 2) & ":" & StringMid($dtmDate, 11, 2) & ":" & StringMid($dtmDate,13, 2))
EndFunc

[BrewManNH]

Sounds like you want to recreate the event viewer. Also, don't use the loop if all you want is the last item put into the log, put an exitloop after the FileWrite and it will jump out of the loop with only the last item in the file.

[Nunos]

Thank you BrewManNH. You are write putting the results in a GUI is probably overly redundant. I will try the other change you have suggested to make it get just one event and writing it to the text file.