‘===========BEGIN CODE================
’======================================
'
' NAME: VS2005_evtcollect.vbs
'
' AUTHOR: Harley Stagner		 
' DATE  : 9/2/2006
'
' COMMENT: This script will query certain servers' event logs for error,
'          warning, information, success audits, and failure audits.  Then,
'          these events are output in human readable format to 5 html files 
'          based on the event type.
'
'=======================================
'***********************************************************
'********Header Section*********************************
'***********************************************************

Option Explicit
On Error Resume Next  
Dim objWMIService, objFile, objEvent, objFSO, objEmail,objServFile
Dim logfile_error 'Used for the error html file.
Dim logfile_warn 'Used for the warning html file.
Dim logfile_info 'Used for the info html file.
Dim logfile_success 'Used for the success audit html file.
Dim logfile_failure 'Used for the failure audit html file.
Dim intCounter 'Used for iterating through array
Dim colLoggedEvents 'Used for storing events when queried
Dim dtDateG, dtTimeG, dtDateW, dtTimeW 'Used for storing converted date,time
Dim strServer 'Used for storing server name to connect to.
Dim serverlist 'Used for storing the location of the server list.

'****************************************************************
'***************Reference Section****************************
'****************************************************************
'* In this section I define the html file and the server list file and set   
'* up a constant for reading and for writing to the appropriate files.  I
'* also set up the file system object to write to the logfile_err and read
'* from the serverlist file.
'***************************************************************** 

logfile_error = "syserrevent.htm"
logfile_warn = "syswarnevent.htm"
logfile_info = "sysinfoevent.htm"
logfile_success = "syssuccevent.htm"
logfile_failure = "sysfailevent.htm"
serverlist = "servers.txt"

Const forReading = 1
Const forWriting = 2
Const forAppending = 8

Set objFSO = CreateObject("Scripting.FileSystemObject")
	Set objFile = objFSO.CreateTextFile(logfile_error)
	Set objFile = objFSO.CreateTextFile(logfile_warn)
	Set objFile = objFSO.CreateTextFile(logfile_info)
	Set objFile = objFSO.CreateTextFile(logfile_success)
	Set objFile = objFSO.CreateTextFile(logfile_failure)
       	
'**************************************
'****Worker/Output Section*******
'**************************************
'* In this section, I set up the html page, then for each server, I run a
'* query for error, warning, information, success audit and failure audit 
'* events in all logs.  Then, I write this information in a readable format
'* to the seperate html files(one for each type of event).  Finally, I
'* stamp the end of html file with the time that the script was completed.
'***************************************

Set objFile = objFSO.OpenTextFile(logfile_error, forWriting)

objFile.WriteLine ("<html><head><title>Vital Log Entries</title></head>")
objFile.WriteLine ("<body bg color='white'>")
objFile.WriteLine ("<h3> Script started " & Now & "</h3><br>")
	
Set objFile = objFSO.OpenTextFile(logfile_warn, forWriting)

objFile.WriteLine ("<html><head><title>Vital Log Entries</title></head>")
objFile.WriteLine ("<body bg color='white'>")
objFile.WriteLine ("<h3> Script started " & Now & "</h3><br>")
	
Set objFile = objFSO.OpenTextFile(logfile_info, forWriting)

objFile.WriteLine ("<html><head><title>Vital Log Entries</title></head>")
objFile.WriteLine ("<body bg color='white'>")
objFile.WriteLine ("<h3> Script started " & Now & "</h3><br>")
	
Set objFile = objFSO.OpenTextFile(logfile_success, forWriting)

objFile.WriteLine ("<html><head><title>Vital Log Entries</title></head>")
objFile.WriteLine ("<body bg color='white'>")
objFile.WriteLine ("<h3> Script started " & Now & "</h3><br>")
	
Set objFile = objFSO.OpenTextFile(logfile_failure, forWriting)

objFile.WriteLine ("<html><head><title>Vital Log Entries</title></head>")
objFile.WriteLine ("<body bg color='white'>")
objFile.WriteLine ("<h3> Script started " & Now & "</h3><br>")
	
Set objServFile = objFSO.OpenTextFile(serverlist, forReading)

Do Until objServFile.AtEndOfStream

	Set objFile = objFSO.OpenTextFile(logfile_error, forAppending)

	strServer = objServFile.ReadLine
	
	Set objWMIService = GetObject("winmgmts:" _
             & "{impersonationLevel=impersonate, (Security)}!\\" & strServer & "\root\cimv2")
	Set colLoggedEvents = objWMIService.ExecQuery _
             	("Select * from Win32_NTLogEvent Where EventType = '1'")
		
	For Each objEvent in colLoggedEvents
    	   dtDateG = CDateWMI(objEvent.TimeGenerated)
    	   dtTimeG = CTimeWMI(objEvent.TimeGenerated)
    	   dtDateW = CDateWMI(objEvent.TimeWritten)
    	   dtTimeW = CTimeWMI(objEvent.TimeWritten)
    	
    	   objFile.WriteBlankLines(1)
    	   objFile.WriteLine ("<hr color='darkblue'>")
    	   objFile.WriteLine ("Computer Name:  <b> " & objEvent.ComputerName & "</b><br>")
    	   objFile.WriteLine ("Time Generated:  " & dtDateG & " " & dtTimeG & "<br>")
    	   objFile.WriteLine ("Time Written: " & dtDateW & " " & dtTimeW & "<br>")
    	   objFile.WriteLine ("Logfile:  " & objEvent.logfile & "<br>")
                objFile.WriteLine ("Category:  " & objEvent.Category & "<br>")
    	   objFile.WriteLine ("Source Name:  " & objEvent.SourceName & "<br>")
    	   objFile.WriteLine ("Event Code:  " & objEvent.EventCode & "<br>")
    	   objFile.WriteLine ("Event Type: <font color='red'>" & objEvent.Type & "</font><br>")
    	   objFile.WriteLine ("User:  " & objEvent.User & "<br>")
    	   objFile.WriteLine ("Message:  " & objEvent.Message & "<br>")
            Next    

	Set objFile = objFSO.OpenTextFile(logfile_warn, forAppending)

	Set objWMIService = GetObject("winmgmts:" _
             & "{impersonationLevel=impersonate, (Security)}!\\" & strServer & "\root\cimv2")
	Set colLoggedEvents = objWMIService.ExecQuery _
             	("Select * from Win32_NTLogEvent Where EventType = '2'")
		
	For Each objEvent in colLoggedEvents
    	   dtDateG = CDateWMI(objEvent.TimeGenerated)
    	   dtTimeG = CTimeWMI(objEvent.TimeGenerated)
    	   dtDateW = CDateWMI(objEvent.TimeWritten)
    	   dtTimeW = CTimeWMI(objEvent.TimeWritten)
    	
    	   objFile.WriteBlankLines(1)
    	   objFile.WriteLine ("<hr color='darkblue'>")
    	   objFile.WriteLine ("Computer Name:  <b> " & objEvent.ComputerName & "</b><br>")
    	   objFile.WriteLine ("Time Generated:  " & dtDateG & " " & dtTimeG & "<br>")
    	   objFile.WriteLine ("Time Written: " & dtDateW & " " & dtTimeW & "<br>")
    	   objFile.WriteLine ("Logfile:  " & objEvent.logfile & "<br>")
                objFile.WriteLine ("Category:  " & objEvent.Category & "<br>")
    	   objFile.WriteLine ("Source Name:  " & objEvent.SourceName & "<br>")
    	   objFile.WriteLine ("Event Code:  " & objEvent.EventCode & "<br>")
    	   objFile.WriteLine ("Event Type: <font color='red'>" & objEvent.Type & "</font><br>")
    	   objFile.WriteLine ("User:  " & objEvent.User & "<br>")
    	   objFile.WriteLine ("Message:  " & objEvent.Message & "<br>")
            Next    

	Set objFile = objFSO.OpenTextFile(logfile_info, forAppending)

	Set objWMIService = GetObject("winmgmts:" _
             & "{impersonationLevel=impersonate, (Security)}!\\" & strServer & "\root\cimv2")
	Set colLoggedEvents = objWMIService.ExecQuery _
             	("Select * from Win32_NTLogEvent Where EventType = '3'")
		
	For Each objEvent in colLoggedEvents
    	   dtDateG = CDateWMI(objEvent.TimeGenerated)
    	   dtTimeG = CTimeWMI(objEvent.TimeGenerated)
    	   dtDateW = CDateWMI(objEvent.TimeWritten)
    	   dtTimeW = CTimeWMI(objEvent.TimeWritten)
    	
    	   objFile.WriteBlankLines(1)
    	   objFile.WriteLine ("<hr color='darkblue'>")
    	   objFile.WriteLine ("Computer Name:  <b> " & objEvent.ComputerName & "</b><br>")
    	   objFile.WriteLine ("Time Generated:  " & dtDateG & " " & dtTimeG & "<br>")
    	   objFile.WriteLine ("Time Written: " & dtDateW & " " & dtTimeW & "<br>")
    	   objFile.WriteLine ("Logfile:  " & objEvent.logfile & "<br>")
                objFile.WriteLine ("Category:  " & objEvent.Category & "<br>")
    	   objFile.WriteLine ("Source Name:  " & objEvent.SourceName & "<br>")
    	   objFile.WriteLine ("Event Code:  " & objEvent.EventCode & "<br>")
    	   objFile.WriteLine ("Event Type: <font color='red'>" & objEvent.Type & "</font><br>")
    	   objFile.WriteLine ("User:  " & objEvent.User & "<br>")
    	   objFile.WriteLine ("Message:  " & objEvent.Message & "<br>")
            Next    

	Set objFile = objFSO.OpenTextFile(logfile_success, forAppending)

	Set objWMIService = GetObject("winmgmts:" _
             & "{impersonationLevel=impersonate, (Security)}!\\" & strServer & "\root\cimv2")
	Set colLoggedEvents = objWMIService.ExecQuery _
             	("Select * from Win32_NTLogEvent Where EventType = '4'")
		
	For Each objEvent in colLoggedEvents
    	   dtDateG = CDateWMI(objEvent.TimeGenerated)
    	   dtTimeG = CTimeWMI(objEvent.TimeGenerated)
    	   dtDateW = CDateWMI(objEvent.TimeWritten)
    	   dtTimeW = CTimeWMI(objEvent.TimeWritten)
    	
    	   objFile.WriteBlankLines(1)
    	   objFile.WriteLine ("<hr color='darkblue'>")
    	   objFile.WriteLine ("Computer Name:  <b> " & objEvent.ComputerName & "</b><br>")
    	   objFile.WriteLine ("Time Generated:  " & dtDateG & " " & dtTimeG & "<br>")
    	   objFile.WriteLine ("Time Written: " & dtDateW & " " & dtTimeW & "<br>")
    	   objFile.WriteLine ("Logfile:  " & objEvent.logfile & "<br>")
                objFile.WriteLine ("Category:  " & objEvent.Category & "<br>")
    	   objFile.WriteLine ("Source Name:  " & objEvent.SourceName & "<br>")
    	   objFile.WriteLine ("Event Code:  " & objEvent.EventCode & "<br>")
    	   objFile.WriteLine ("Event Type: <font color='red'>" & objEvent.Type & "</font><br>")
    	   objFile.WriteLine ("User:  " & objEvent.User & "<br>")
    	   objFile.WriteLine ("Message:  " & objEvent.Message & "<br>")
             Next    

	Set objFile = objFSO.OpenTextFile(logfile_failure, forAppending)

	Set objWMIService = GetObject("winmgmts:" _
             & "{impersonationLevel=impersonate, (Security)}!\\" & strServer & "\root\cimv2")
	Set colLoggedEvents = objWMIService.ExecQuery _
             	("Select * from Win32_NTLogEvent Where EventType = '5'")
		
	For Each objEvent in colLoggedEvents
    	   dtDateG = CDateWMI(objEvent.TimeGenerated)
    	   dtTimeG = CTimeWMI(objEvent.TimeGenerated)
    	   dtDateW = CDateWMI(objEvent.TimeWritten)
    	   dtTimeW = CTimeWMI(objEvent.TimeWritten)
    	
    	   objFile.WriteBlankLines(1)
    	   objFile.WriteLine ("<hr color='darkblue'>")
    	   objFile.WriteLine ("Computer Name:  <b> " & objEvent.ComputerName & "</b><br>")
    	   objFile.WriteLine ("Time Generated:  " & dtDateG & " " & dtTimeG & "<br>")
    	   objFile.WriteLine ("Time Written: " & dtDateW & " " & dtTimeW & "<br>")
    	   objFile.WriteLine ("Logfile:  " & objEvent.logfile & "<br>")
                objFile.WriteLine ("Category:  " & objEvent.Category & "<br>")
    	   objFile.WriteLine ("Source Name:  " & objEvent.SourceName & "<br>")
    	   objFile.WriteLine ("Event Code:  " & objEvent.EventCode & "<br>")
    	   objFile.WriteLine ("Event Type: <font color='red'>" & objEvent.Type & "</font><br>")
    	   objFile.WriteLine ("User:  " & objEvent.User & "<br>")
    	   objFile.WriteLine ("Message:  " & objEvent.Message & "<br>")
           Next    
Loop

Set objFile = objFSO.OpenTextFile(logfile_error, forAppending)

objFile.Write "<h3>Scan Completed at " & Now & "</h3><br>"
objFile.Write "</body></html>"
objFile.Close

Set objFile = objFSO.OpenTextFile(logfile_warn, forAppending)

objFile.Write "<h3>Scan Completed at " & Now & "</h3><br>"
objFile.Write "</body></html>"
objFile.Close

Set objFile = objFSO.OpenTextFile(logfile_info, forAppending)

objFile.Write "<h3>Scan Completed at " & Now & "</h3><br>"
objFile.Write "</body></html>"
objFile.Close

Set objFile = objFSO.OpenTextFile(logfile_success, forAppending)

objFile.Write "<h3>Scan Completed at " & Now & "</h3><br>"
objFile.Write "</body></html>"
objFile.Close

Set objFile = objFSO.OpenTextFile(logfile_failure, forAppending)

objFile.Write "<h3>Scan Completed at " & Now & "</h3><br>"
objFile.Write "</body></html>"
objFile.Close

WScript.Quit	
	
'*****************************************
'***Function Section*******************
'*****************************************
'* These functions are used to convert the date and time into a readable
'* format.  These are called in the output section of the script.
'******************************************

Function CDateWMI(cim_DateTime)
	Dim sDateTime, iYear, iMonth, iDay
	
	sDateTime = CStr(cim_DateTime)
	
	iYear = CInt(Mid(sDateTime, 1, 4))
	iMonth = CInt(Mid(sDateTime, 5, 2))
	iDay = CInt(Mid(sDateTime, 7, 2))
	
	CDateWMI = CDate(Join(Array(iMonth, iDay, iYear), "/"))
End Function

Function CTimeWMI(cim_DateTime)
	Dim sDateTime, iHours, iMinutes, iSeconds
	
	sDateTime = CStr(cim_DateTime)
	
	iHours = CInt(Mid(sDateTime, 9, 2))
	iMinutes= CInt(Mid(sDateTime, 11, 2))
	iSeconds = CInt(Mid(sDateTime, 13, 2))
	
	CTimeWMI = TimeSerial(iHours, iMinutes, iSeconds)
End Function
‘========== END CODE======