'Lecture des enregistrements des journaux d'événements de Windows
'Source originale : Cedric NANA, LABORATOIRE SUPINFO DES TECHNOLOGIES MICROSOFT (Equipe Recherche)
'Publiée le 11/05/2005 http://www.laboratoire-microsoft.org/scripts/14221/
'Descriptif de Win32_NTLogEvent
'http://www.secretswindows.com/index.php?rubrique=scripts&ssrubrique=WMI&page=./scripts/wmi/win32ntlogevent.htm
'
'Selection sur LogFile="Application" ou "System", Type="erreur" et TimeGenerated <= à 15h
'
Option Explicit
'Création fichier resultat pour envoi mail automatisé
Dim resultat : resultat = "D:\Observateur_événements_" & Replace(Date, "/","-") & ".txt"
Dim Fso : Set Fso = CreateObject("Scripting.fileSystemObject")
Dim Rapport : Set Rapport = Fso.openTextFile(resultat, 2, True)
Dim strComputer, objWMIServices, objWMIObjectSet, objWMIObject
strComputer = "."
Set objWMIServices = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set objWMIObjectSet = objWMIServices.ExecQuery ("Select * from Win32_NTLogEvent")
For Each objWMIObject In objWMIObjectSet
If (objWMIObject.LogFile = "Application" Or objWMIObject.LogFile = "System") And _
objWMIObject.Type = "erreur" And _
DateDiff("h", clair(objWMIObject.TimeGenerated), Now) <= 15 Then
Rapport.writeLine "----------------------------------------------------"
Rapport.writeLine "Ordinateur: " & objWMIObject.ComputerName
Rapport.writeLine "Observateur d'événements: " & objWMIObject.LogFile
Rapport.writeLine "----------------------------------------------------"
Rapport.writeLine "Type: " & UCase(Left(objWMIObject.Type,1)) & mid(objWMIObject.Type,2)
Rapport.writeLine "Date: " & clair(objWMIObject.TimeGenerated)
Rapport.writeLine "Source: " & objWMIObject.SourceName
Rapport.writeLine "ID évén.: " & objWMIObject.EventCode
Rapport.writeLine "Utilisateur: " & objWMIObject.User
Rapport.writeLine "Numéro d'enregistrement: " & objWMIObject.RecordNumber
Rapport.writeLine "Description: " &vbCrLf& objWMIObject.Message
End If
Next
Set fso = Nothing : Set Rapport = Nothing
Set objWMIObjectSet = Nothing : Set objWMIServices = Nothing
Dim WshShell : Set WshShell = CreateObject("WScript.Shell")
WshShell.Run resultat
Set WshShell = Nothing
Function clair(temps)
Dim debut, an, mois, jour, hhmn
debut = left(temps,8)
an = left(debut,4)
mois = mid(debut,5,2)
jour = right(debut,2)
hhmn = " " & Mid(temps,9,2) & ":" & Mid(temps,11,2)
clair = CStr(jour) & "/" & CStr(mois) & "/" & CStr(an) & hhmn
End function