Reading Hyper-V Events using Script RRS feed

  • Question



    I want to retrieve Hyper-V events from a VB script.

    To do this I tried using WMI class Win32_NTLogEvent. Script code is pasted below.
    But that gives data only of one Hyper-V event source "Microsoft-Windows-Hyper-V-Hypervisor".
    but basically I am interested more in getting events of source "Hyper-V-Worker", "Hyper-V-VMMS", "Hyper-V-Network", "Hyper-V-Config", etc.

    WMI Script I have used is as follows:-


    On Error Resume Next
    strComputer = "."
    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
    Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent")
    For Each objItem in colItems

               Wscript.Echo "Category: " & objItem.Category & vbCrLf & "CategoryString: " &_
                      objItem.CategoryString & vbCrLf & "ComputerName: " &_
                      objItem.ComputerName & vbCrLf & "Data: " & objItem.Data &_
                      vbCrLf & "EventCode: " & objItem.EventCode & vbCrLf &_
                      "EventIdentifier: " & objItem.EventIdentifier & vbCrLf &_
                      "InsertionStrings: " & objItem.InsertionStrings & vbCrLf &_
                      "Logfile: " & objItem.Logfile & vbCrLf & "Message: " &_
                      objItem.Message & vbCrLf & "RecordNumber: " & objItem.RecordNumber &_
                      vbCrLf & "SourceName: " & objItem.SourceName & vbCrLf &_
                      "TimeGenerated: " & objItem.TimeGenerated & vbCrLf & "TimeWritten: " &_
                      objItem.TimeWritten & vbCrLf & "Type: " & objItem.Type & vbCrLf &_
                      "User: " & objItem.User

    Does any one know if there is a WMI class which will help in writing VB script to fetch above Hyper-V events?


    My purpose it to get one row for all attributes of one event.
    With wevtutil I have to parse it again in a format I want.

    So I think I can not go with wevtutil


    Thanks and Regards,

    Wednesday, December 31, 2008 8:43 AM

All replies

  • I don't know much about accessing Events from WMI. But if you can switch to Powershell, there is a new inbox cmdlet called get-winevent. The cmdlet will output each event as an object & you can format it out as you wish.
    Sunday, March 29, 2009 6:22 AM
  • Hi Geeta,

    unfortunately there is no option to read the Hyper-V logs from the Win32_NTLogEvent class. The events are stored in logfiles that aren't covered in this class. However, you can use the "wevtutil" command to query the log, eg.:

    wevtutil qe "Microsoft-Windows-Hyper-V-VMMS-Admin"

    This will output in XML format. To get these log events in text format, use the /f:text switch:
    wevtutil qe "Microsoft-Windows-Hyper-V-VMMS-Admin" /f:text

    To get a list of all Event Logs:
    wevtutil el

    Hope this helps you out a bit.

    kind regards,
    Floris van der Ploeg
    Tuesday, April 21, 2009 8:07 PM
  • Floris,
    Do you know how i can get a report to tell me the name of all host servers and Virtual servers on those hosts within Hyper - V.  this can be done on VM ware, so i assume there is a script that can help with hyper - v.  if i can export a file to csv or xls that would be ideal.  also, is there a way to get CPU information for all host servers and assigned cores for the virtual servers?

    Thanks for your help,
    Wednesday, January 13, 2010 10:12 PM
  • Why the hell would Microsoft remove certain event log functionality?

    Is it not the age of PowerShell, yet I can not query the archaic mess of 200 new sub-catergorised folders.

    Tuesday, May 20, 2014 7:13 AM