Ereignisanzeige auslesen und in *.txt-Datei schreiben

Public Function xxx()
  Dim strComputer As String
  Dim objWMIService As Object
  Dim colLoggedEvents As Object
  Dim objEvent As Object
  Dim i As Integer
  Dim FILTERED As Boolean
  
  Dim DeinArrayMitEventTypeIntegers(0 To 1) As Integer
    DeinArrayMitEventTypeIntegers(0) = 3
    DeinArrayMitEventTypeIntegers(1) = 2

    strComputer = "."  
    Set objWMIService = GetObject("winmgmts:" & "\\" & strComputer & "\root\cimv2")  
    
    Set colLoggedEvents = objWMIService.ExecQuery("Select * from Win32_NTLogEvent Where Logfile = 'Application'")  
    
    For Each objEvent In colLoggedEvents
      For i = LBound(DeinArrayMitEventTypeIntegers) To UBound(DeinArrayMitEventTypeIntegers)
        If (objEvent.EventType = DeinArrayMitEventTypeIntegers(i)) Then FILTERED = True
      Next i
      If Not FILTERED Then
        Debug.Print "Category: " & objEvent.Category  
        Debug.Print "Computer Name: " & objEvent.ComputerName  
        Debug.Print "Event Code: " & objEvent.EventCode  
        Debug.Print "Message: " & objEvent.Message  
        Debug.Print "Record Number: " & objEvent.RecordNumber  
        Debug.Print "Source Name: " & objEvent.SourceName  
        Debug.Print "Time Written: " & objEvent.TimeWritten  
        Debug.Print "Event Type: " & objEvent.Type  
        Debug.Print "User: " & objEvent.User  
      End If
      FILTERED = False
    Next objEvent
End Function

  Dim DeinArrayMitEventTypeIntegers(1)
    DeinArrayMitEventTypeIntegers(0) = 1
    DeinArrayMitEventTypeIntegers(1) = 1

Call outputEventsToFile("C:\Test.txt","Application",DeinArrayMitEventTypeIntegers)  

Public Sub outputEventsToFile(ByVal filename,ByVal LogFileType,ByVal filteredEvents())
On Error Resume Next
  Dim strComputer 
  Dim objWMIService 
  Dim colLoggedEvents 
  Dim objEvent 
  Dim i 
  Dim FILTERED
  Dim fso, f
  Set fso = CreateObject("Scripting.FileSystemObject")  
  Set f = fso.OpenTextFile(filename, 2, True)  

    strComputer = "."  
    Set objWMIService = GetObject("winmgmts:" & "\\" & strComputer & "\root\cimv2")      
    Set colLoggedEvents = objWMIService.ExecQuery("Select * from Win32_NTLogEvent Where Logfile = '" & LogFileType & "'")  
    
    For Each objEvent In colLoggedEvents
      For i = LBound(DeinArrayMitEventTypeIntegers) To UBound(DeinArrayMitEventTypeIntegers)
        If (objEvent.EventType = DeinArrayMitEventTypeIntegers(i)) Then
          FILTERED = True
          Exit For
        End If
      Next 

      If Not FILTERED Then
        f.WriteLine( "Category: " & objEvent.Category)  
        f.WriteLine "Computer Name: " & objEvent.ComputerName  
        f.WriteLine "Event Code: " & objEvent.EventCode  
        f.WriteLine "Message: " & objEvent.Message  
        f.WriteLine "Record Number: " & objEvent.RecordNumber  
        f.WriteLine "Source Name: " & objEvent.SourceName  
        f.WriteLine "Time Written: " & objEvent.TimeWritten  
        f.WriteLine "Event Type: " & objEvent.Type  
        f.WriteLine "User: " & objEvent.User  
      End If
      FILTERED = False
    Next
    f.Close
End Sub

CONST EVENTTYPE_ERROR             = "1"  
CONST EVENTTYPE_WARNING           = "2"  
CONST EVENTTYPE_INFORMATION       = "3"  
CONST EVENTTYPE_SUCCESSAUDIT      = "4"  
CONST EVENTTYPE_FAILUREAUDIT      = "5"  

strComputer = "."  
arrEventType = array( EVENTTYPE_ERROR, EVENTTYPE_WARNING , EVENTTYPE_FAILUREAUDIT)
Set objWMIService = GetObject("winmgmts:" & "\\" & strComputer & "\root\cimv2")  
strSelect = "Select * from Win32_NTLogEvent Where Logfile = 'Application'"  
'--------------------> hier 4 Beispiele für das Zusammenbasteln des SELECT-Strings  
'--------------------> wahlweise auskommentieren  
' Set colLoggedEvents = objWMIService.ExecQuery (strSelect   & " AND EventType = '" & "1" & "' ")  
' Set colLoggedEvents = objWMIService.ExecQuery (strSelect   & " AND EventType = '" & EVENTTYPE_ERROR & "' ")  
' Set colLoggedEvents = objWMIService.ExecQuery (strSelect   & " AND EventType <> '" & EVENTTYPE_ERROR & "' ")  
Set colLoggedEvents = objWMIService.ExecQuery (strSelect   & " AND EventType = '" & arrEventType(1) & "' ")  
'Remember: arrEventType(1) == EVENTTYPE_WARNING   
For Each objEvent In colLoggedEvents
      WScript.Echo "Category: " & objEvent.Category  
      WScript.Echo "Computer Name: " & objEvent.ComputerName  
      WScript.Echo "Event Code: " & objEvent.EventCode  
      WScript.Echo "Message: " & objEvent.Message  
      WScript.Echo "Record Number: " & objEvent.RecordNumber  
      WScript.Echo "Source Name: " & objEvent.SourceName  
      WScript.Echo "Time Written: " & objEvent.TimeWritten  
      WScript.Echo "Event Type: " & objEvent.Type  
      WScript.Echo "User: " & objEvent.User  
Next
'P.S. VBS würde auch zulassen:  
'Set colLoggedEvents = objWMIService.ExecQuery (strSelect   & " AND EventType = '" & 1 & "' ")  
'.... also einen numerischen Wert in den String reinzudrücken...aber dieses "feature" wollte ich mir nicht angewöhnen.  
'  

...
where = "Logfile='Application' "  

For i = LBound([array()]) To UBound([array()])
     If i <> UBound([array()]) Then
         where = where &  " AND EventType<>" & array(i)   
     End If
Next
...

On Error Resume Next
  filter() = Array(3,2)
	
  sql = "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Application' "  

  For i = LBound(filter) To UBound(filter)
	sql = sql & " AND EventType<>" & filter(i)  
  Next

  Set objWMIService = GetObject("winmgmts:" & "\\.\root\cimv2")      
  Set colLoggedEvents = objWMIService.ExecQuery(sql)    
  For Each objEvent In colLoggedEvents
    WScript.Echo "Category: " & objEvent.Category  
    WScript.Echo "Computer Name: " & objEvent.ComputerName  
    WScript.Echo "Event Code: " & objEvent.EventCode  
    WScript.Echo "Message: " & objEvent.Message  
    WScript.Echo "Record Number: " & objEvent.RecordNumber  
    WScript.Echo "Source Name: " & objEvent.SourceName  
    WScript.Echo "Time Written: " & objEvent.TimeWritten  
    WScript.Echo "Event Type: " & objEvent.Type  
    WScript.Echo "User: " & objEvent.User  
  Next