'
' Author:      tlviewer@yahoo.com
' script:	AppLogBS.vbs 
' Description: enumerate the Event log and parse out chkdsk output about state of fs
' keywords: wbem query event log wmi
' Date:      04/21/06
' 

'#define EVENTLOG_SUCCESS                0x0000
'#define EVENTLOG_ERROR_TYPE             0x0001
'#define EVENTLOG_WARNING_TYPE           0x0002
'#define EVENTLOG_INFORMATION_TYPE       0x0004
'#define EVENTLOG_AUDIT_SUCCESS          0x0008
'#define EVENTLOG_AUDIT_FAILURE          0x0010 

'
'echo Y | chkdsk /f c:
 
dim WSHShell 
Set WSHShell = WScript.CreateObject("WScript.Shell.1")

' list of strings to pull out of the event log to print
dim arFilter
   arFilter = Array("bad sector", "file system on")

sOut = ""
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colAL = objWMIService.ExecQuery _
    ("Select * from Win32_NTLogEvent Where Logfile = 'Application' and SourceName = 'WinLogon'" )

sOut  = sOut &  "Error Count in AppLog Event Log: " & colAL.count & vbCrLf  

For Each objItem in colAL
    sOut  = sOut &  "############# TimeEvent: " & WMIDateStringToDate(objItem.TimeWritten)  & " ################" & vbCrLf 
    sOut  = sOut &  "Type: " & objItem.Type                                                                       & vbCrLf 
    sOut  = sOut &  "Description: " & Filter(arFilter,objItem.Message)                                              & vbCrLf 
Next 

' Wscript.echo sOut
npdump(sOut)

Function WMIDateStringToDate(dtmWMIDate)
    If Not IsNull(dtmWMIDate) Then
    WMIDateStringToDate = CDate(Mid(dtmWMIDate, 5, 2) & "/" & _
         Mid(dtmWMIDate, 7, 2) & "/" & Left(dtmWMIDate, 4) _
             & " " & Mid (dtmWMIDate, 9, 2) & ":" & _
                 Mid(dtmWMIDate, 11, 2) & ":" & Mid(dtmWMIDate, _
                     13, 2))
    End If
End Function 

Function Filter(arFilter, strMsg)
    myOut = ""
    If Not IsNull(arFilter) Then 
    arMsg = split(strMsg, vbCrLf)  
    for nJ = 0 to ubound(arMsg)
         for nK = 0 to ubound(arFilter) 
            if instr( arMsg(nJ), arFilter(nK) ) > 0 then
               myOut  = myOut &  arMsg(nJ) & vbCrLf 
            end if
         next            
    next
    End If
    Filter = myOut
End Function

function npdump(sOut)
' helper objects and vars
   dim  objFS, TempName, objTempFile, MyBase
   
   Set objFS = WScript.CreateObject("Scripting.FileSystemObject")
   ' setup the temp file sent to Notepad later
   TempName = WshShell.Environment("PROCESS").Item("TEMP")
   MyBase = objFS.GetTempName
   MyBase = objFS.GetBaseName(MyBase)
   TempName = TempName & "\~" & MyBase & ".txt"
   set objTempFile = objFS.CreateTextFile( TempName,  false,false)
   objTempFile.WriteLine sOut
   objTempFile.Close
   WSHShell.Run "notepad " & TempName, 1, True
   objFS.DeleteFile TempName, True 
end function