WMI query with categorystring

[Dirk]

When doing a query towards a Win2K box the below SQL statement:

select * from win32_ntlogevent where logfile='Security' and
sourcename='Security' and categorystring='Account Logon' and eventcode='680'
and recordnumber> 10

I get no matching records

If I do
select * from win32_ntlogevent where logfile='Security' and
sourcename='Security' and category=9 and eventcode='680' and recordnumber>
10
I do get matching records

From my understanding category=9 is the same as categorystring='Account
Logon'


Any ideas when a query using the "categorystring" isn't returning matching
records while doing it with category it is.
And IF I can only use category in the query instead of categorystring, is
there somewere a full list of category(string)s? That way I can at least
show my uses a list of what they can select.


dirk;

 

[Jason Lee \(MSFT\)]

If you run the second query (with category=9) in wbemtest, and then open one
of the returned entries, is the category string what you expect? ('Account
Logon')

-Jason

 

[Dirk]

I tried it from within VB and that was the string I got back.

That's also what you see using the eventviewer.

dirk.