none
WMI query for getting application event giving zero result. RRS feed

  • Question

  • Hi all,

    I am using the below code to get application log from windows 2003 and 2008.

    =============================================================================================

    Private Function FetchApplicationLogEvent() As Integer
            Dim intCount As Integer = 0
            Dim i As Integer = 0
            Try
                Dim logtype As String = "Application"
                Dim strDomaincontrollerName = _strRmtIp
                Dim sServerPath As String = "\\" + strDomaincontrollerName + "\root\cimv2"
                Dim conOptions As New ConnectionOptions(Nothing, _strRmtUserId, _strRmtPassword, "ntlmdomain:WORKGROUP", ImpersonationLevel.Impersonate, AuthenticationLevel.[Call], _
                                                         True, Nothing, New TimeSpan())

                Dim Scope As New ManagementScope(sServerPath, conOptions)
                Try
                    Try
                        Console.WriteLine("Connecting to remote server(" + _strRmtName + ") " + _strRmtIp + " ...........")
                        Scope.Connect()
                        WriteLogFile(My.Computer.Name, "FetchApplicationLogEvent()", "Successfully connected to Remote Server.")
                        Console.ForegroundColor = ConsoleColor.Green
                        Console.WriteLine("Connected to " + _strRmtIp)
                    Catch ex As Exception
                        '_errMsg = ex.Message.ToString()
                        'Send email to user those who are subscribed for this current domain name.
                        Console.ForegroundColor = ConsoleColor.Red
                        WriteLogFile(My.Computer.Name, "FetchApplicationLogEvent()", ex.Message.ToString() + Environment.NewLine + "Remote IP :" + _strRmtIp + Environment.NewLine + "User Id :" + _strUserID + Environment.NewLine + "Password :" + _strPassword)
                        Console.WriteLine("Connection failed to " + _strRmtIp + " :" + ex.Message)
                        SendConnectionErrorEmail(_intDomainId, logtype)
                        Exit Function
                    End Try
                    Console.ForegroundColor = ConsoleColor.White
                    Console.WriteLine("Getting application log from " + _strRmtIp)

                    Dim wmiQuery As New ObjectQuery()
                    'wmiQuery.QueryString = "Select * from Win32_NTEventLogFile Where LogFileName = '" + logtype + "'"
                    wmiQuery.QueryString = "Select * from Win32_NTLogEvent Where Logfile = '" + logtype + "'"
                    'wmiQuery.QueryString = "Select * from Win32_NTLogEvent Where Logfile = 'Application'"
                    Dim options As New EnumerationOptions()
                    options.Rewindable = False
                    options.ReturnImmediately = True

                    Dim results As New ManagementObjectSearcher(Scope, wmiQuery, options)
                    Dim objs As ManagementObjectCollection = results.[Get]()

                    Dim timewritten As DateTime
                  
                    For Each mo As ManagementObject In objs
                        Try
                            timewritten = ManagementDateTimeConverter.ToDateTime(mo("TimeWritten").ToString())
                        Catch ex As Exception

                        End Try

    End Function

    =============================================================================================

    Same for security and system by chenging the where clause in the wmi query.

    But on my machine i am able to get all logs, but on client side where the server is same 2003 and 2008 both i am able to get only security log i am getting 0 result for application and system? Why?

    Is there any server level settings who is denying  the access to fetch the application and system.

    any help would be appreciated.

    Friday, July 27, 2012 10:36 AM

All replies

  • Hi Shambhu,

    Welcome to the MSDN Forum.

    Did you try to run it as administrator?

    Best regards,


    Mike Feng
    MSDN Community Support | Feedback to us
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    Monday, July 30, 2012 8:59 AM
    Moderator