Event Log Error

[de Graff]

I built all of our servers with the same Windows Server 2003 CD and (I
believe) I have set them up with the same options. Does anyone know why the
following query from a remote machine works on some servers and not on
others? The error disappears when I remove the TimeWritten portion of the
query. The error I get indicates an invalid query (syntax).

Select * from Win32_NTLogEvent Where Logfile = 'Application' and SourceName
= 'LiveState Recovery' and TimeWritten >= '2007-03-11' and TimeWritten <=
'2007-03-11 23:59:59'

 

[de Graff]

OK. I found the problem. Some servers (but not others for some strange
reason) require that the TimeWritten query reference th SWbemDateTime helper
object. So the correct query becomes

set lower = CreateObject("WbemScripting.SWbemDateTime")
set upper = CreateObject("WbemScripting.SWbemDateTime")

lower.SetVarDate Date-offset,true
upper.SetVarDate Date-offset+1,true

Set wmi = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & server
& "\root\cimv2")
query = "Select * from Win32_NTLogEvent" _
& " Where Logfile = 'Application'" _
& " and SourceName = 'LiveState Recovery'" _
& " and TimeWritten >= '" & lower & "'" _
& " and TimeWritten < '" & upper & "'"
Set events = wmi.ExecQuery(query)

with offset set to an integer (1=yesterday)