Viewing The Event Logs Remotely Via an ASP = Page with WMI

Viewing = The Event=20 Logs Remotely Via an ASP Page with = WMI

By Peter A. Bromberg,=20 Ph.D.

<= /TR>

If you administrate = a web=20 server on a remote machine, then you know how = important it can=20 be to be able to quickly view your event logs and = "check on=20 things" Until recently, the only way to do this was to = log=20 onto the machine via Terminal Services, VNC or PC = Anywhere,=20 log onto the desktop, and bring up event viewer that = way. Or,=20 you could use somebody's component.

Fortunately,. the = Windows=20 Management Instrumentation (WMI) interface has become = so=20 sophisticated -- and scriptable -- that we can now do = all this=20 using these scripting interfaces in an ASP page. Not = only=20 that, but we can make things a lot easier by creating = a form -=20 based query interface that lets you enter search terms = to get=20 back only what you need to see.

The key to all this = is an=20 implementation of the Desktop Management Task Force's = (DMTF)=20 Web-Based Enterprise Management (WBEM) initiative for=20 Microsoft=C2=AE Windows platforms that extends the = Common=20 Information Model (CIM) to represent management = objects in=20 Windows management environments. The Common = Information Model,=20 also a DMTF standard, is an extensible data model for=20 logically organizing management objects in a = consistent,=20 unified manner in a managed environment. It = provides:

A rich query = language=20 that enables detailed queries of the information=20 model.
A scriptable API = that=20 developers can use to create management = applications. The=20 scripting API supports several languages, including=20 Microsoft Visual Basic=C2=AE; Visual Basic for = Applications=20 (VBA); Visual Basic, Scripting Edition (VBScript); = Microsoft=20 JScript=C2=AE development software. Besides VBScript = and JScript,=20 developers can use any scripting language = implementation=20 that supports Microsoft's ActiveX=C2=AE Scripting = technologies=20 with this API (for example, a Perl scripting = engine).=20 Additionally, you can use the Windows Scripting Host = or=20 Microsoft Internet Explorer to run scripts utilizing = this=20 interface. Windows Scripting Host, like Internet = Explorer,=20 serves as a controller engine of ActiveX scripting = engines.=20 Windows Scripting Host supports scripts written in = VBScript=20 and JScript.

What we'll do here is = use the=20 scripting interface to write an ASP web page that can = be=20 loaded from the IIS machine just like any web page, = and that=20 allows us to view and search the Event Logs:

<% ' Event Log=20 Reader by Peter A Bromberg' In our first script block, we = simply=20 check to see if the form has been submitted. If so, we = instantiate the Wscript.Network object to ' get an = instance=20 of the computer name, and display = itif Request.Form("SUBMIT") =3D = ""=20 then set oNet=20 = =3DCreateObject("WScript.Network") compname=3DoNet.Computername Res= ponse.write=20 "<BASEFONT FACE=3DVerdana>" Response.write = "Viewing: "=20 & compname & "<BR>" set oNet =3D=20 Nothing %> <FORM ACTION =3DeventLog.asp=20 METHOD=3DPOST> <Table cellpadding=3D2 = cellspacing=3D2=20 border=3D0> <TR><TD> <input = type=3Dtext=20 name=3Dcn=20 = value=3D<%=3Dcompname%>></TD><TD>computer=20 = name</td></TR> <TR><TD><select=20 name=3DLF> <option=20 = value=3Dapplication>application</option> <option=20 value=3Dsystem>system</option> <option=20 = value=3Dsecurity>security</option> </select></TD>= <TD>Log=20 = File</TD></TR> <TR><TD><input=20 type =3Dtext name=3Ds></TD><TD>Event=20 = Source</TD></TR> <TR><TD><select=20 name=3Dt> <option=20 value=3D>ALL</option> <option=20 = value=3Dinformation>information</option> <option=20 = value=3Dwarning>warning</option> <option=20 = value=3Derror>error</option> </select></TD><TD= >Type</TD></TR> <TR><TD><input=20 type=3Dtext name=3De></TD><TD>Event=20 = Code</TD></TR> <TR><TD><input=20 type=3Dtext=20 = name=3Du></TD><TD>UserName</TD></TR> <TR= ><TD><input=20 type=3Dpassword=20 = name=3Dp></TD><TD>Password</TD></TR> <TR= ><TD=20 COLSPAN=3D2 Align=3Dcenter><input type=3DSUBMIT = NAME=3DSUBMIT=20 = VALUE=3DCHECK></TD></TR> </TABLE> </FORM>= ;<% ' The = form was=20 submitted, so let's do our processing of the user's=20 query.. else

'Declare and initialize the variables = we=20 need...Dim wmiServices, wmiResultSet,=20 wmiRecord Dim strComputer, strLogfile, = strWqlQuery Dim=20 dtDate, dtTime set oNet=20 =3DCreateObject("WScript.Network") set wmiLocator = =3D=20 = CreateObject("WbemScripting.SWbemLocator") strComputer =3D=20 oNet.ComputerName ' create = the base=20 query, and add the user's selections to the query = string=20 ... strWqlQuery =3D "SELECT * FROM = Win32_NTLogEvent=20 WHERE Logfile=3D" If(Request.Form("cn") <> = "") Then=20 strComputer =3D=20 Request.Form("cn") If(Request.Form("LF")<> = "") Then=20 strLogfile =3D Request.Form("LF") strWqlQuery =3D = strWqlQuery=20 & """" & strLogfile &=20 """" If(Request.Form("s")<> "") Then = strWqlQuery =3D=20 strWqlQuery & " AND SourceName=3D" & """" = &=20 Request.Form("s") & """" If(Request.Form("t")=20 <>"") Then strWqlQuery =3D strWqlQuery & " = AND Type=3D"=20 & """" & Request.Form("t") &=20 """" If(Request.Form("e") <>"") Then = strWqlQuery =3D=20 strWqlQuery & " AND EventCode=3D" & """" & = Request.Form("e") & """"

' Connect to the default machine, or = optionally=20 to another machine and accept username and pasword=20if Request.form("u") <> "" = then Set=20 wmiServices =3D wmiLocator.ConnectServer(strComputer , = "root\default", Request.form("u"),=20 Request.Form("p")) else Set wmiServices =3D=20 wmiLocator.ConnectServer(strComputer ) end = if ' Execute our WMI = query... Set=20 wmiResultSet =3D=20 = wmiServices.ExecQuery(strWqlQuery) If(wmiResultSet.Count =3D=20 0) Then Response.write "<b>Query: """ &=20 strWqlQuery & """ returned 0=20 records.</b>" Else ' = Display=20 the results in a nice table.. Response.write = "<Table Cellspacing=3D2 cellpadding=3D2 border=3D0=20 style=3D""font-face:tahoma;=20 font-size:9pt;"">" Response.write "<TR=20 bgcolor=3Dlightblue style=3D""font-face:tahoma;=20 = font-size:9pt;""><TH>Rec</TH><TH>Type</TH><= TH>Date</TH><TH>Time</TH><TH>Source</TH>= <TH>Category</TH><TH>Cat=20 = Strg</TH><TH>Event</TH><TH>Usr</TH><TH&g= t;Computer</TH><TH>Msg</TH></TR>" For=20 Each wmiRecord In wmiResultSet dtDate =3D=20 CWmiDate(wmiRecord.TimeGenerated) dtTime =3D=20 CWmiTime(wmiRecord.TimeGenerated) i =3D i +1 if = i mod 2 =3D=20 0 then response.write "<TR=20 BGCOLOR=3D#ffcc66>" else response.write = "<TR=20 BGCOLOR=3Dlightgrey>" end if response.write=20 "<TD>" & wmiRecord.RecordNumber &" = </TD>"=20 & _ "<TD>" & wmiRecord.Type &=20 "</TD>" & _ "<TD>" & dtDate = &=20 "</TD>" & _ "<TD>" & dtTime = &=20 "</TD>" & _ "<TD>" &=20 wmiRecord.SourceName & "</TD>" &=20 _ "<TD>" & wmiRecord.Category & = "</TD>"=20 & _ "<TD>" & wmiRecord.CategoryString = &=20 "</TD>" & _ "<TD>" &=20 wmiRecord.EventCode & "</TD>" &=20 _ "<TD>" & wmiRecord.User & = "</TD>"=20 & _ "<TD>" & wmiRecord.ComputerName = &=20 "</TD>" & _ "<TD>" & = wmiRecord.Message=20 & "</TD></TR>"

Next Response.write "</TABLE>=20 </FONT>"
' provide a link at the bottom = to perform=20 a new query...
Response.write "<DIV=20 align=3Dcenter><A HREF=3Deventlog.asp>New=20 Query</a></DIV>"

' Cleanup objects..Set oNet = =3D=20 Nothing Set wmiLocator =3DNothing Set=20 wmiServices=3DNothing Set wmiResultSet =3D = Nothing End=20 If

' Helper functions for date and time = formatting=20 of the CIM DateTime object...Function=20 CWmiDate(cim_DateTime) Dim strDateTime, iYear, = iMonth,=20 iDay strDateTime =3D CStr(cim_DateTime) iYear = =3D=20 CInt(Mid(strDateTime, 1, 4)) iMonth =3D = CInt(Mid(strDateTime,=20 5, 2)) iDay =3D CInt(Mid(strDateTime, 7, = 2)) CWmiDate =3D=20 CDate(Join(Array(iMonth, iDay, iYear), "/")) End=20 Function Function CWmiTime(cim_DateTime) Dim=20 strDateTime, iHours, iMinutes, iSeconds strDateTime = =3D=20 CStr(cim_DateTime) iHours =3D CInt(Mid(strDateTime, = 9,=20 2)) iMinutes =3D CInt(Mid(strDateTime, 11, = 2)) iSeconds =3D=20 CInt(Mid(strDateTime, 13, 2)) CWmiTime =3D = TimeSerial(iHours,=20 iMinutes, iSeconds) End Function end=20 if %>

-- And there it is! Your own custom Event = Viewer page!=20 Enjoy.

Download=20 the code that accompanies this = article

Peter Bromberg is = an=20 independent consultant specializing in distributed = .NET=20 solutionsa Senior Programmer /Analyst at in Orlando = and a=20 co-developer of the EggheadCafe.com=20 developer website. He can be reached at pbromberg@yahoo.com

Do you have a question or comment about this = article?=20 Have a programming problem you need to solve? Post it at eggheadcafe.com = forums=20 and receive immediate email notification of = responses.