VB Script help in writing event logs to excel - vbscript

Question

I have the below script to fetch the event logs from system and write to an excel. It is running fine on 'Windows 7', but on 'Windows Server 2003', it is taking 7-8 minutes to write the systems logs, and it writes the Application logs within seconds. However there are very few number of errors in the system logs.
Another problem is I am using MyDate = DateAdd("h", -8, Now()) in the script but it fetches logs for more than 12 hours ago. This time calculation is not functioning correctly.
Your help will be highly appreciated.
Here is the script:
Option Explicit
Dim objFSO, objFolder, objFile, objWMI, objItem, objItem1, objItem2 ' Objects
Dim strComputer, strFileName, strFileOpen, strFolder, strPath, oExcel, oWB, oSheet, oSheet1, oSheet2
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents, colLoggedEvents2, colLoggedEvents3, MyDate, dtm, row, row1, row2, Query, ServerTime
MyDate = DateAdd("h", -8, Now())
'---------------------------------------------------------
On Error Resume Next
Set oExcel=CreateObject("Excel.Application")
oExcel.Visible=true
Set oWB=oExcel.Workbooks.Open ("D:\EventLogs2.xls")
Set oSheet=oWB.Worksheets.Add ( , oWB.WorkSheets(oWB.WorkSheets.Count))
Set oSheet1=oWB.Worksheets.Add ( , oWB.WorkSheets(oWB.WorkSheets.Count))
Set oSheet2=oWB.Worksheets.Add ( , oWB.WorkSheets(oWB.WorkSheets.Count))
oSheet.Name="Application"
oSheet1.Name="Security"
oSheet2.Name="System"
strComputer = "."
ServerTime = Now
intRecordNum = 0
row = 0
row1 = 0
row2 = 0
' ----------------------------------------------------------
' WMI Core Section
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("SELECT * FROM Win32_NTLogEvent where Logfile = 'Application' and " _
& "EventType = '1' and TimeWritten > '" & MyDate & "'")
Set colLoggedEvents2 = objWMI.ExecQuery _
("SELECT * FROM Win32_NTLogEvent where Logfile = 'Security' and " _
& "EventType = '1' and TimeWritten > '" & MyDate & "'")
Set colLoggedEvents3 = objWMI.ExecQuery _
("SELECT * FROM Win32_NTLogEvent where Logfile = 'System' and " _
& "EventType = '1' and TimeWritten > '" & MyDate & "'")
' ----------------------------------------------------------
' Next section loops through ID properties
For Each objItem in colLoggedEvents
If objItem.EventType=1 then
row = row+1
osheet.Cells(row,1).Value = ("Logfile: " & objItem.Logfile _
& " source " & objItem.SourceName)
osheet.Cells(row,2).Value = ("Message: " & objItem.Message)
osheet.Cells(row,3).Value = ("TimeGenerated: " & WMIDateStringToDate(objItem.TimeGenerated))
osheet.Cells(row,4).Value = ServerTime
End If
Next
For Each objItem1 in colLoggedEvents2
If objItem1.EventType=1 then
row1 = row1+1
osheet1.Cells(row1,1).Value = ("Logfile: " & objItem1.Logfile _
& " source " & objItem1.SourceName)
osheet1.Cells(row1,2).Value = ("Message: " & objItem1.Message)
osheet1.Cells(row1,3).Value = ("TimeGenerated: " & WMIDateStringToDate(objItem1.TimeGenerated))
osheet1.Cells(row1,4).Value = ServerTime
End If
Next
For Each objItem2 in colLoggedEvents3
If objItem2.EventType=1 then
row2 = row2+1
osheet2.Cells(row2,1).Value = ("Logfile: " & objItem2.Logfile _
& " source " & objItem2.SourceName)
osheet2.Cells(row2,2).Value = ("Message: " & objItem2.Message)
osheet2.Cells(row2,3).Value = ("TimeGenerated: " & WMIDateStringToDate(objItem2.TimeGenerated))
osheet2.Cells(row2,4).Value = ServerTime
intRecordNum = intRecordNum +1
End If
Next
Function WMIDateStringToDate(dtmDate)
WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
& " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function
oWB.save
oWB.Application.Quit
WScript.Quit

Answer 1

Can't you just write to a CSV file?
Something like this:
Option Explicit
Dim objFSO, objFolder, objFile, objWMI, objItem, objItem1, objItem2 ' Objects
Dim strComputer, strFileName, strFileOpen, strFolder, strPath, oExcel, oWB, oSheet, oSheet1, oSheet2
Dim intEvent, intNumberID, intRecordNum, colLoggedEvents, colLoggedEvents2, colLoggedEvents3, MyDate, dtm, row, row1, row2, Query, ServerTime
MyDate = DateAdd("h", -8, Now())
'---------------------------------------------------------
On Error Resume Next
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.CreateTextFile("D:\EventLogs2.csv", True)
strComputer = "."
ServerTime = Now
intRecordNum = 0
row = 0
row1 = 0
row2 = 0
' ----------------------------------------------------------
' WMI Core Section
Set objWMI = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" _
& strComputer & "\root\cimv2")
Set colLoggedEvents = objWMI.ExecQuery _
("SELECT * FROM Win32_NTLogEvent where Logfile = 'Application' and " _
& "EventType = '1' and TimeWritten > '" & MyDate & "'")
Set colLoggedEvents2 = objWMI.ExecQuery _
("SELECT * FROM Win32_NTLogEvent where Logfile = 'Security' and " _
& "EventType = '1' and TimeWritten > '" & MyDate & "'")
Set colLoggedEvents3 = objWMI.ExecQuery _
("SELECT * FROM Win32_NTLogEvent where Logfile = 'System' and " _
& "EventType = '1' and TimeWritten > '" & MyDate & "'")
' ----------------------------------------------------------
' Next section loops through ID properties
For Each objItem in colLoggedEvents
If objItem.EventType=1 then
objFile.WriteLine("Logfile: " & objItem.Logfile & "," & " source " & objItem.SourceName & "," & _
"Message: " & objItem.Message & "," & _
"TimeGenerated: " & WMIDateStringToDate(objItem.TimeGenerated) & "," & _
ServerTime)
End If
Next
For Each objItem1 in colLoggedEvents2
If objItem1.EventType=1 then
objFile.WriteLine("Logfile: " & objItem1.Logfile & "," & " source " & objItem1.SourceName & "," & _
"Message: " & objItem1.Message & "," & _
"TimeGenerated: " & WMIDateStringToDate(objItem1.TimeGenerated) & "," & _
ServerTime)
End If
Next
For Each objItem2 in colLoggedEvents3
If objItem2.EventType=1 then
objFile.WriteLine("Logfile: " & objItem2.Logfile & "," & " source " & objItem2.SourceName & "," & _
"Message: " & objItem2.Message & "," & _
"TimeGenerated: " & WMIDateStringToDate(objItem2.TimeGenerated) & "," & _
ServerTime)
End If
Next
Function WMIDateStringToDate(dtmDate)
WMIDateStringToDate = CDate(Mid(dtmDate, 5, 2) & "/" & _
Mid(dtmDate, 7, 2) & "/" & Left(dtmDate, 4) _
& " " & Mid (dtmDate, 9, 2) & ":" & Mid(dtmDate, 11, 2) & ":" & Mid(dtmDate,13, 2))
End Function
objFile.Close
Set objFile = Nothing
Set objFSO = Nothing