Large WMI notification query may cause a quota violation
Jake
I am querying the Security Event log for all events, and the event log is
128MB in size. I am writing every event to a text file as it is being read
from the Security event viewer. The process executes for a number of minutes
until the text file reaches about 51MB, then I get the following Windows
Script Host error on my Windows Server 2003 sp2 machine:
Line: 181
Char: 2
Error: 0x8004106C
Code: 8004106C
Source: (null)
I saw KB 828653 "Large WMI notification query may cause a quota violation",
but found that since I had sp2 installed the properties for the Esscli.dll
file on this server vs. that listed in the KB article 828653, the server
version is newer. The server version of Esscli.dll is: version 5.2.3790.3959
(Srv03_Sp2_rtm.070216-1710). I called Microsoft on this and they told me
that the hotfix didn't apply and that I'd have to pay $259 to get help with
this.
I can't justify that cost given the error is exactly what should have been
fixed and is known by Microsoft, so i'm left on my own. Can anyone please
help me??
The line (181) of code that is pointed to in the failure is the last line
(Next) below.
Code:
' Overwrite/create the Eventlog.txt
Set strFile = objFSO.CreateTextFile(strPath, True)
strFile.WriteLine(strLogName & "event log exported for " _
& objComputer & " on: " & Now()) & vbcrlf
'---------------------------------------------------------------------
' Connect to, and query WMI for Event Viewer
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("Select * from Win32_NTLogEvent Where Logfile = " & strEventLog)
' --------------------------------------------------------------------
' Enumerate/filter event properties and write them to the Eventlog.txt
bOverNinetyDays = False
EventCount = 0
NewEventCount = 0
For Each objItem in colLoggedEvents
dtmTimeGenerated = dtmStringToDate(objItem.TimeGenerated)
If CompareDates(dtmNinetyDaysAgo, dtmTimeGenerated) < 0 Then
bOverNinetyDays = True
End If
If CompareDates(dtmYoungest, dtmTimeGenerated) > 0 Then
strFile.WriteLine("Type: " & objItem.Type)
strFile.WriteLine("Date/Time: " & dtmTimeGenerated)
strFile.WriteLine("Source: " & objItem.SourceName)
strFile.WriteLine("Event ID: " & objItem.EventCode)
strFile.WriteLine("Computer: " & objItem.ComputerName)
strFile.WriteLine("User: " & objItem.User)
strFile.WriteLine("Category: " & objItem.CategoryString)
strFile.WriteLine("Description: " & objItem.Message)
strFile.WriteLine (" ")
EventCount = EventCount + 1
End If
If EventCount >= EventLimit Then
Exit For
End If
Next
Can you please assist me with this issue?
Thanks,
Jake
TDM
"Jake" <Ja...@discussions.microsoft.com> wrote in message news:064F6D57-B416-4B61...@microsoft.com...
You may want to have a look at LogParser from M$.
I have used this to query remote Event logs of large
sizes with no problem. I can post an example script,
but you can also find lots of examples from M$ as well.
TDM
TDM
"Jake" <Ja...@discussions.microsoft.com> wrote in message news:064F6D57-B416-4B61...@microsoft.com...
Sorry, forgot to mention that you only need
to install Logparser on the system doing the
queries.
TDM