Vbscript VB脚本帮助将事件日志写入excel

我有下面的脚本从系统中获取事件日志并写入excel。它在“Windows 7”上运行正常，但在“Windows Server 2003”上，写入系统日志需要7-8分钟，并且它在几秒钟内写入应用程序日志。但是，系统日志中的错误数量很少

另一个问题是我在脚本中使用MyDate=DateAdd（“h”，-8，Now（）），但它在12个多小时前获取日志。此时间计算功能不正确

我们将非常感谢你的帮助

以下是脚本：

Option Explicit

Dim objFSO, objFolder, objFile, objWMI, objItem, objItem1, objItem2 ' Objects
Dim strComputer, strFileName, strFileOpen, strFolder, strPath, oExcel, oWB, oSheet, oSheet1, oSheet2  
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents, colLoggedEvents2, colLoggedEvents3, MyDate, dtm, row,      row1, row2, Query, ServerTime
MyDate = DateAdd("h", -8, Now())

'---------------------------------------------------------

On Error Resume Next

Set oExcel=CreateObject("Excel.Application")
oExcel.Visible=true
Set oWB=oExcel.Workbooks.Open ("D:\EventLogs2.xls")
Set oSheet=oWB.Worksheets.Add ( , oWB.WorkSheets(oWB.WorkSheets.Count))
Set oSheet1=oWB.Worksheets.Add ( , oWB.WorkSheets(oWB.WorkSheets.Count))
Set oSheet2=oWB.Worksheets.Add ( , oWB.WorkSheets(oWB.WorkSheets.Count))
oSheet.Name="Application"
oSheet1.Name="Security"
oSheet2.Name="System"

strComputer = "." 
ServerTime = Now              

intRecordNum = 0
row = 0
row1 = 0
row2 = 0

' ----------------------------------------------------------
' WMI Core Section 
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _ 
& strComputer & "\root\cimv2")

Set colLoggedEvents = objWMI.ExecQuery _ 
       ("SELECT * FROM Win32_NTLogEvent where Logfile = 'Application' and " _ 
        & "EventType = '1' and TimeWritten > '" & MyDate & "'")
Set colLoggedEvents2 = objWMI.ExecQuery _ 
       ("SELECT * FROM Win32_NTLogEvent where Logfile = 'Security' and " _         
        & "EventType = '1' and TimeWritten > '" & MyDate & "'")
Set colLoggedEvents3 = objWMI.ExecQuery _ 
       ("SELECT * FROM Win32_NTLogEvent where Logfile = 'System' and " _ 
        & "EventType = '1' and TimeWritten > '" & MyDate & "'")

' ----------------------------------------------------------
' Next section loops through ID properties

For Each objItem in colLoggedEvents                                    
If objItem.EventType=1 then                                                        
row = row+1
osheet.Cells(row,1).Value = ("Logfile: " & objItem.Logfile _ 
& " source " & objItem.SourceName) 
osheet.Cells(row,2).Value = ("Message: " & objItem.Message)
osheet.Cells(row,3).Value = ("TimeGenerated: " & WMIDateStringToDate(objItem.TimeGenerated))
osheet.Cells(row,4).Value = ServerTime

End If
Next


For Each objItem1 in colLoggedEvents2
If objItem1.EventType=1 then
row1 = row1+1
osheet1.Cells(row1,1).Value = ("Logfile: " & objItem1.Logfile _ 
& " source " & objItem1.SourceName) 
osheet1.Cells(row1,2).Value = ("Message: " & objItem1.Message)
osheet1.Cells(row1,3).Value = ("TimeGenerated: " & WMIDateStringToDate(objItem1.TimeGenerated))
osheet1.Cells(row1,4).Value = ServerTime

End If
Next                                                               


For Each objItem2 in colLoggedEvents3        
If objItem2.EventType=1 then
row2 = row2+1
osheet2.Cells(row2,1).Value = ("Logfile: " & objItem2.Logfile _ 
& " source " & objItem2.SourceName) 
osheet2.Cells(row2,2).Value = ("Message: " & objItem2.Message)
osheet2.Cells(row2,3).Value = ("TimeGenerated: " & WMIDateStringToDate(objItem2.TimeGenerated))
osheet2.Cells(row2,4).Value = ServerTime

intRecordNum = intRecordNum +1
End If
Next

Function WMIDateStringToDate(dtmDate) 
 WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _ 
 Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _ 
 & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2)) 
End Function

oWB.save
oWB.Application.Quit
WScript.Quit

---

你不能直接写入CSV文件吗

大概是这样的：

Option Explicit

Dim objFSO, objFolder, objFile, objWMI, objItem, objItem1, objItem2 ' Objects
Dim strComputer, strFileName, strFileOpen, strFolder, strPath, oExcel, oWB, oSheet, oSheet1, oSheet2  
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents, colLoggedEvents2, colLoggedEvents3, MyDate, dtm, row,      row1, row2, Query, ServerTime
MyDate = DateAdd("h", -8, Now())

'---------------------------------------------------------

On Error Resume Next

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.CreateTextFile("D:\EventLogs2.csv", True)

strComputer = "." 
ServerTime = Now              

intRecordNum = 0
row = 0
row1 = 0
row2 = 0

' ----------------------------------------------------------
' WMI Core Section 
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _ 
& strComputer & "\root\cimv2")

Set colLoggedEvents = objWMI.ExecQuery _ 
       ("SELECT * FROM Win32_NTLogEvent where Logfile = 'Application' and " _ 
        & "EventType = '1' and TimeWritten > '" & MyDate & "'")
Set colLoggedEvents2 = objWMI.ExecQuery _ 
       ("SELECT * FROM Win32_NTLogEvent where Logfile = 'Security' and " _         
        & "EventType = '1' and TimeWritten > '" & MyDate & "'")
Set colLoggedEvents3 = objWMI.ExecQuery _ 
       ("SELECT * FROM Win32_NTLogEvent where Logfile = 'System' and " _ 
        & "EventType = '1' and TimeWritten > '" & MyDate & "'")

' ----------------------------------------------------------
' Next section loops through ID properties

For Each objItem in colLoggedEvents                                    
If objItem.EventType=1 then                                                        
    objFile.WriteLine("Logfile: " & objItem.Logfile & "," & " source " & objItem.SourceName & "," & _
        "Message: " & objItem.Message & "," & _
        "TimeGenerated: " & WMIDateStringToDate(objItem.TimeGenerated) & "," & _
        ServerTime)
End If
Next


For Each objItem1 in colLoggedEvents2
If objItem1.EventType=1 then
    objFile.WriteLine("Logfile: " & objItem1.Logfile & "," & " source " & objItem1.SourceName & "," & _
        "Message: " & objItem1.Message & "," & _
        "TimeGenerated: " & WMIDateStringToDate(objItem1.TimeGenerated) & "," & _
        ServerTime)
End If
Next                                                               


For Each objItem2 in colLoggedEvents3        
If objItem2.EventType=1 then
    objFile.WriteLine("Logfile: " & objItem2.Logfile & "," & " source " & objItem2.SourceName & "," & _
        "Message: " & objItem2.Message & "," & _
        "TimeGenerated: " & WMIDateStringToDate(objItem2.TimeGenerated) & "," & _
        ServerTime)
End If
Next

Function WMIDateStringToDate(dtmDate) 
 WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _ 
 Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _ 
 & " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2)) 
End Function

objFile.Close
Set objFile = Nothing
Set objFSO = Nothing

---

7-8什么？分钟小时？加仑？您是否确定脚本中的哪个步骤花费了太多的时间（例如，通过记录每个步骤之前/之后的时间戳）？很抱歉，忘了提及，时间是7-8分钟。同样，您是否确定脚本中的哪个步骤花费了太多的时间？Ansgar Wiechers，实际上我要去度假，我将在3月10日回到我的办公室，然后我会检查一下，一定会让你知道的。非常感谢您继续关注此内容。我会尝试此操作并让您知道，非常感谢您的回复。您的脚本在第44、54和64行出现错误。原因是缺少了&。我添加了这个“&”，但之后在运行脚本时没有发生任何事情，即使它没有抛出任何错误。@IftakharAhmad我刚刚编辑了答案并更正了您所说的内容。它是否创建了CSV文件？即使在写入CSV时，也需要相同的时间。我们已迁移到Windows Server 2012，并且在那里相同的脚本正常工作。它在几秒钟内将事件日志写入excel。