Alternatives to the EventLog Object

For new scripts, use the following methods and properties of the Win32_NTEventlogFileWMI class to achieve equivalent results.

[VBScript] 
'*********************************************************************
' Routine: Function BackupEventLog
' Purpose: A replacement for the EventLog.BackupEventLog method
' Notes: Additional credentials are required to work with the 
'		 Security event log.
'**********************************************************************
Function BackupEventLog(strEventLogName, strOutputFolderName, ByRef
strSavedFileName, strComputer)
	Dim objEventlogFiles, objEventlogFile
	Dim strBackupLogName
	Dim lngResult
	Dim strQuery

	strBackupLogName =  "OMEventLog_" & strEventLogName &
"_" & _ 
						Month(Now) & "_" & Day(Now()) &
"_" & Hour(Now()) _ 
						 & "_" & Minute(Now()) & "_"
& Second(Now()) & ".evt"

	strSavedFileName = strOutputFolderName & "/" &
strBackupLogName

	strQuery = "SELECT * FROM Win32_NTEventLogFile WHERE
LogfileName='" & strEventLogName & "'"
	Set objEventlogFiles =
GetObject("WinMgmts:{impersonationLevel=impersonate,(Backup)}").ExecQuery(strQuery)

	For Each objEventlogFile In objEventlogFiles
	 lngResult = objEventlogFile.BackupEventlog(strSavedFileName)
	Next

	Set objEventlogFiles = Nothing
	Set objEventlogFile =  Nothing

	BackupEventLog = lngResult
End Function

[VBScript] 
'*********************************************************************
' Routine: Function ClearEventLog
' Purpose: A replacement for the EventLog.ClearEventLog method
' Notes: Additional credentials are required to work with the 
'		 Security event log.
'**********************************************************************
Function ClearEventLog(strEventLogName, strOutputFolderName, ByRef
strSavedFileName, strComputer)
	Dim objEventlogFile, objEventlogFiles
	Dim lngResult
	Dim strQuery

	strQuery = "SELECT * FROM Win32_NTEventLogFile WHERE
LogfileName='" & strEventLogName & "'"
	Set objEventlogFiles =
GetObject("WinMgmts:{impersonationLevel=impersonate,(Backup)}").ExecQuery(strQuery)

	For Each objEventlogFile In objEventlogFiles
		' BackupEventLog - uses the function in the previous
example
	 BackupEventLog(strEventLogName, strOutputFolderName,
strSavedFileName, strComputer)
	 lngResult = objEventlogFile.ClearEventlog()
	Next

	Set objEventlogFiles = Nothing
	Set objEventlogFile =  Nothing

	ClearEventLog = lngResult
End Function

[VBScript] 
'*********************************************************************
' Routine: Function GetNumberOfEventLogRecords
' Purpose: A replacement for EventLog.GetNumberOfEventLogRecords
' Notes: Additional credentials are required to work with the 
'		 Security event log.
'**********************************************************************
Function GetNumberOfEventLogRecords(strEventLogName, ByRef
lngNumRecords, strComputer)
	Dim objEventlogFiles, objEventlogFile
	Dim strQuery

	strQuery = "SELECT * FROM Win32_NTEventLogFile WHERE
LogfileName='" & strEventLogName & "'"
	Set objEventlogFiles =
GetObject("WinMgmts:{impersonationLevel=impersonate,(Backup)}").ExecQuery(strQuery)

	For Each objEventlogFile In objEventlogFiles
	 lngNumRecords = objEventlogFile.NumberOfRecords
	Next

	Set objEventlogFiles = Nothing
	Set objEventlogFile = Nothing

	GetNumberOfEventLogRecords = lngNumRecords
End Function

For more information about the Win32_NTEventlogFileclass, see the Windows Management Instrumentation SDK.

Did you find this information useful? Please send your suggestions and comments about the documentation to momsdk@microsoft.com.