The book you need to succeed! Vbscript, jscript

246
 Part 
II
 
Windows VBScript and JScript
The results look like this:
Type      Date        Time        Source   Category  Event   User   Computer
Warning   08/15/2008  7:24:36 PM  WSH      None      2       N/A    ZETA
Error     08/15/2008  7:13:08 PM  WSH      None      1       N/A    ZETA
The event description is available, but only if you double-click on the event in the Event Viewer. 
Keep in mind that if you save the event log to a text file, the description is not saved, which will 
probably mean that you won’t be able to determine the meaning of the event.
Working with the LogEvent method
To write events to the application event log, use the 
LogEvent
 method of the 
WshShell
 object. The 
syntax for this method is:
LogEvent(eventType, eventDescription [,remoteSystem]) 
in which 
eventType
 is a numeric identifier for the event type, 
eventDescription
 is a text descrip-
tion of the event, and 
remoteSystem
 is an optional value that specifies the system on which you want 
to log the event.
Event types you can specify are summarized in Table 12-4. You set the event type as the first argu-
ment for 
LogEvent
. If the logging succeeds, 
LogEvent
 returns 
True
. If the logging fails, 
LogEvent
 
returns 
False
.
TABLE 12-4
Specifying Event Types for the LogEvent Method
Event
Value
Event Type
Successful execution
0
Information
Execution error
1
Error 
Warning; possible problem
2
Warning 
Information
4
Information
Audit of successful action
8
Success Audit
Audit of failed action
16
Failure Audit
Typically, you’ll want to use the event log to record the successful or failed execution of the script. For 
example, if the script is performing nightly backups, you’d want to track the success or failure of the 
backup process. If you build a 
main
 function into the script, you can record the outcome of the execu-
tion as shown in Listing 12-7. Of course, there are many other ways that you can handle event logging.
86804c12.indd   246
86804c12.indd   246
1/21/09   1:26:55 PM
1/21/09   1:26:55 PM

---

247
 
Working with the Windows Registry and Event Logs 
12
LISTING 12-7
Writing to an Event Log
VBScript
writelog.vbs
Set ws = WScript.CreateObject(“WScript.Shell”) 
ex = main()
If ex Then
 ws.LogEvent 0, “WriteLog.VBS Script Completed Successfully”
Else
 ws.LogEvent 1, “Error executing WriteLog.VBS”
End If
Function main()
 ‘add main routine
 WScript.Echo “Write log test...”
If err.Number <> 0 Then
 main = 1 
Else
 main = 0
End If
End Function
JScript
writelog.js
var ws = WScript.CreateObject(“WScript.Shell”) 
ex = main()
if (ex == 0) {
 //successful execution 
 ws.LogEvent(0, “WriteLog.JS Script Completed Successfully”)
 }
else {
 //failed execution
 ws.LogEvent(1, “Error executing WriteLog.JS”)
}
function main() {
 //add main routine
 try {
 //add code to try
 WScript.Echo(“Write log test...”)
 }
 catch(e) {
  return 1
 }
 return 0
}
86804c12.indd   247
86804c12.indd   247
1/21/09   1:26:55 PM
1/21/09   1:26:55 PM

---

248
 Part 
II
 
Windows VBScript and JScript
Reading Event Logs
The 
EventLog
 method makes writing to event logs fairly easy. Unfortunately, there isn’t a simple 
method that you can use to read event logs. Primarily, this is because event logs have a complex 
structure and you really need a tool that can search the event logs for relevant information, rather 
than a tool that simply reads the events. While you can use the built-in capabilities of VBScript and 
JScript to create log-searching and extraction routines, you don’t need to do this. Instead, you can 
use Dumpel to handle all of the dirty work for you. Dumpel is a resource kit utility designed to help 
you analyze event logs.
To use the examples in this section, Dumpel must be in a directory that is accessible to 
the command path. The default installation location for resource kit utilities is Program 
Files\Resource Kit. This directory is not in the standard command path. You can add this directory to 
the path or you can move the Dumpel utility to the %SystemRoot% directory. To view the current 
command path, start a command prompt and then type path. To add the resource kit directory to the 
command path, start a command prompt and then type the following command:
set PATH=%PATH%;F:\Program Files\Resource Kit
in which F:\Program Files\Resource Kit is the location of the resource kit.
Introducing Dumpel
Dumpel provides many different ways to examine information in event logs. You can dump entire 
event logs on specific systems and write the logs to files, search the event logs for specific events by 
ID, or even search event logs for events logged by a specific user. The syntax for Dumpel follows:
dumpel [/f ] [/s ] [/l [/m  
[/r]]]
       [/e ] [/c] [/ns] [/t] [/d ]
Each of the arguments for Dumpel is summarized in Table 12-5.
TABLE 12-5
Arguments for Dumpel
Argument
Description
/b
Filters an existing dump log.
/c
Uses commas to separate fields. If not specified, a space is used.
/d
Filters events for the past n days. Value must be greater than 0.
/e
Filters by event ID. You can specify up to 10 event IDs in a space-separated list. 
You must use /m to specify a source as well.
NOTE
NOTE
86804c12.indd   248
86804c12.indd   248
1/21/09   1:26:55 PM
1/21/09   1:26:55 PM

---