Note that there are some explanatory texts on larger screens.

plurals
  1. POWMI is being too slow
    primarykey
    data
    text
    <p>Is there a way to limit the number of entries WMI retrieves with a WQL statement? I say this because running a query to retrieve all Win32_NTLogEvent instances is taking forever! All I really need are the most recent events (for about a week, or 2000 entries)</p> <p>Here's a snippet of the code I'm using to get the log data. Other queries such as Win32_Processor are nice and quick.</p> <pre><code> if (Configuration.OnlyErrorLogs) { // If Information logs should be suppressed, only get events where event type is not 3 WMIDataTemp1 = DataRetriever.GetWMIData("Win32_NTLogEvent", "EventType&lt;&gt;3"); } else { WMIDataTemp1 = DataRetriever.GetWMIData("Win32_NTLogEvent"); } foreach (ManagementObject Object in WMIDataTemp1) { this.Log.Add(new Log(Object)); } </code></pre> <p>And the functions to get WMI data are as follows:</p> <pre><code> public static ManagementObject[] GetWMIData(string wmiClass) { return GetWMIData(wmiClass, "", "CIMV2"); } public static ManagementObject[] GetWMIData(string wmiClass, string whereClause) { return GetWMIData(wmiClass, whereClause, "CIMV2"); } public static ManagementObject[] GetWMIData(string wmiClass, string whereClause, string nameSpace) { try { // If a where clause has been set, prepare the clause to add to the query string if (whereClause != "") { whereClause = " WHERE " + whereClause; } // Create a search query string query = "SELECT * FROM " + wmiClass + whereClause; ManagementObjectSearcher wmiSearcher = new ManagementObjectSearcher("root\\" + nameSpace, query); ManagementObjectCollection matches = wmiSearcher.Get(); // Create an array to hold the matches ManagementObject[] matchArray = new ManagementObject[matches.Count]; // If matches found, copy to output if(matches.Count &gt; 0) { // Copy the search matches into this array matches.CopyTo(matchArray, 0); } // Return array return matchArray; } catch (Exception e) { ErrorDialogue errorReporter = new ErrorDialogue(e); return null; } } </code></pre> <p>Where each Log gets stored:</p> <pre><code>public class Log { public string Category = "N/A"; public string DateTime = "N/A"; public UInt16 ID = 0; public string Level = "N/A"; public string Message = "N/A"; public string Source = "N/A"; public Log() { } public Log(ManagementObject wmiLogEvent) { this.GetInfo(wmiLogEvent); } public void GetInfo(ManagementObject wmiLogEvent) { try { this.Category = DataRetriever.GetValue(wmiLogEvent, "CategoryString"); this.DateTime = DataRetriever.GetValue(wmiLogEvent, "TimeGenerated"); this.ID = DataRetriever.GetValueUInt16(wmiLogEvent, "EventIdentifier"); this.Level = DataRetriever.ConvertEventType(DataRetriever.GetValueUInt16(wmiLogEvent, "CategoryString")); this.Message = DataRetriever.GetValue(wmiLogEvent, "Message"); this.Source = DataRetriever.GetValue(wmiLogEvent, "SourceName"); } catch (Exception e) { ErrorDialogue errorReporter = new ErrorDialogue(e); } } } </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload