{"id":90,"date":"2007-03-14T14:53:56","date_gmt":"2007-03-14T22:53:56","guid":{"rendered":"http:\/\/testblog.sapien.com\/index.php\/2007\/03\/14\/improved-remote-wmi-event-log-queries\/"},"modified":"2007-03-14T14:53:56","modified_gmt":"2007-03-14T22:53:56","slug":"improved-remote-wmi-event-log-queries","status":"publish","type":"post","link":"https:\/\/dev.sapien.com\/blog\/2007\/03\/14\/improved-remote-wmi-event-log-queries\/","title":{"rendered":"Improved Remote WMI Event Log Queries"},"content":{"rendered":"

I responded to a comment about querying remote event logs<\/a> using WMI.  The issue is performance, especially when filtering.  The commenter was using code like this:<\/p>\n

$d=get-date
$BeginDate=[System.Management.ManagementDateTimeConverter]::ToDMTFDateTime($d.AddDays(-7))
$B = get-wmiobject –class win32_ntlogevent –computerName $FQDNservername -credential $Credentials | Where-object { $_.logfile -eq “system” -and ($_.eventcode –eq “20048” -and $_.TimeWritten -ge $BeginDate) } | select-object Logfile,EventCode,TimeGenerated,TimeWritten,Message<\/font><\/p>\n

I tried it out while running a network trace and it took a long time to complete.  Lots of WMI information coming across the wire. Then I realized it is slow because the the Get-WMIObject cmdlet has to complete first, then it has to send the results to the Where-Object cmdlet.  The better approach is to use a WMI query so the results are filtered in place.  Here’s my revised code, that also includes a technique to indicate how long the process took:<\/p>\n

$start=Get-Date
$d=Get-Date
$computer=”dc01”
$BeginDate=[System.Management.ManagementDateTimeConverter]::ToDMTFDateTime($d.AddDays(-7))
<\/font>$B = get-wmiobject -query “Select Logfile,Eventcode,TimeGenerated,TimeWritten,Message from win32_ntlogevent where logfile=’System’ AND eventcode=’7036’ AND TimeWritten >=’$BeginDate’” -computername $computer
$end=Get-Date
<\/font>$Runtime=$end-$start
$B | Select TimeGenerated,TimeWritten,EventCode,Message |format-table
<\/font>write-host $b.count “records”
<\/font>write-host “Runtime: ” $runtime.hours “hrs” $runtime.minutes “min” $runtime.seconds “sec” $runtime.milliseconds “ms” <\/font><\/font><\/p>\n

Now the query completes in a fraction of the time. <\/p>\n

Technorati tags: <\/span>PowerShell<\/span><\/a>, <\/span>WMI<\/span><\/a>, <\/span>EventLogs<\/span><\/a>, <\/span>Get-WMIObject<\/span><\/a><\/div>\n
del.icio.us tags: <\/span>PowerShell<\/span><\/a>, <\/span>WMI<\/span><\/a>, <\/span>EventLogs<\/span><\/a>, <\/span>Get-WMIObject<\/span><\/a><\/div>\n","protected":false},"excerpt":{"rendered":"

I responded to a comment about querying remote event logs using WMI.  The issue is performance, especially when filtering.  The commenter was using code like this: $d=get-date$BeginDate=[System.Management.ManagementDateTimeConverter]::ToDMTFDateTime($d.AddDays(-7)) $B = get-wmiobject –class win32_ntlogevent –computerName $FQDNservername -credential $Credentials | Where-object { $_.logfile -eq “system” -and ($_.eventcode –eq “20048” -and $_.TimeWritten -ge $BeginDate) } | select-object Logfile,EventCode,TimeGenerated,TimeWritten,Message I […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[25],"tags":[],"class_list":["post-90","post","type-post","status-publish","format-standard","hentry","category-windows-powershell"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/90","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/comments?post=90"}],"version-history":[{"count":0,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/posts\/90\/revisions"}],"wp:attachment":[{"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/media?parent=90"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/categories?post=90"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dev.sapien.com\/blog\/wp-json\/wp\/v2\/tags?post=90"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}