Re: Retrieving the contents of colLoggedEvents==>objEvent.Message

Never mind. After much experimentation I found
that the only way to get what I wanted was to
open a file, write the "message" field out to the
file, close the file, open it in read mode, read the
file a line at a time - parsing it as I went - and
then deleting it after I closed it so I could start
fresh with the next entry in the log file.

A ugly way to have to do to get what I wanted
to get but it works even if it does take longer and
chews up cycles (and requires a whale of a lot
of code). I did learn a lot about scripting along
the way.

Thanks anyway.

David

"David Schrader" <schrader@xxxxxxxxxxx> wrote in message
news:uc4Kf83eGHA.5040@xxxxxxxxxxxxxxxxxxxxxxx
To anyone who can help. I'm trying to pull out the logon and logoff
information
from the objEvent,Message The problem is that all of the data stored in
the
objEvent.Message "field" is a series of strings all separated by
*vbCrLfs*,
which, of course, doesn't really lend itself to using the "split" function
(as I
found by trying it) - see example below. ("Split" desired because it
builds
an array of value which can then be searched.)

Any alternative suggestions for (easily and cleanly) pull the various
fields
out of objEvent.Message into a series of Array elements so that each
element can then be checked for specific elements?

All help appreciated.

David

' NOTE: all variables, Const, etc are defined earlier
Set colLoggedEvents = objWMIService.ExecQuery _
("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'Security'")
For Each objEvent in colLoggedEvents
If ((objEvent.Category = 2) or (objEvent.Category = 4 )) Then
If ( ( _
instr( 1, objEvent.User, "NETWORK SERVICE", vbTextCompare) _
OR instr( 1, objEvent.User, "SYSTEM" , vbTextCompare) _
OR instr( 1, objEvent.User, "LOCAL SERVICE" , vbTextCompare) _
OR instr( 1, objEvent.User, "ANONYMOUS" , vbTextCompare) _
) ) Then
' Do nothing --- it works fine to here...
Else
If ( objEvent.EventCode = LogOn_EventCode ) Then
' The "SPLIT" command aborts. Take it out and everything works
fine
' but I don't get the information I need.
' myArray = split(objEvent.Message, vbCrLf, -1 , vbTextCompare )
' MsgBox myArray
' objTextFile.WriteLine myArray
Else
End If
End If
End If
Next




.