code:

---

; to be run with KiXtart 4.11
; has not been tested under any previous version

break on
cls

dim $rc
$rc=SETCONSOLE('SHOW')
$rc=SETCONSOLE('FOREGROUND')
$rc=SETOPTION('Explicit','ON')
$rc=SETOPTION('HideCursor','ON')
$rc=SETOPTION('NoVarsInStrings','ON')
$rc=SETOPTION('WrapAtEOL','ON')

? 'KiXtart v'+@KIX

dim $eventlog, $eventid, $events, $event
dim $computer, $username, $password, $date

; pull all log-on events from the SECURITY evenltlog
$eventlog='Security'
$eventid=528

; specify the name of the remote comuter, a username with administrative access
; and the password for that username
$computer='workstaion'
$username='administrator'
$password='password'

$date=@DATE+' '+@TIME

;$events=GetEvents($eventlog, $eventid)

;$events=GetEvents($eventlog, $eventid, $date)

? ''
? 'Calling GetEvents'
$events=GetEvents($eventlog, $eventid,,'workstation')

? ''
? 'Calling GetEvents'
$events=GetEvents($eventlog, $eventid,,'workstation',$username,$password)

? ''
? 'Calling GetEvents'
$events=GetEvents($eventlog, $eventid,,'server')

? ''
? 'Calling GetEvents'
$events=GetEvents($eventlog, $eventid,,'server',$username,$password)

;for each $event in $events
;  ? 'Event = '+$event
;next
;FUNCTION      GetEvents()
;
;ACTION        Retreives event from the eventlog
;
;VERSION       0.9
;
;KIXTART VER   4.11
;
;AUTHOR        Jens Meyer
;
;SYNTAX        RETCODE = GETEVENTS(EVENTLOG, EVENTID, OPTIONAL DATE, 
;                                  OPTIONAL COMPUTER, OPTIONAL USERNAME,
;                                  OPTIONAL PASSWORD)
;
;PARAMETERS    self-explanatory ?
;
;RETURN        array of events or empty string (not yet implemented)
;
;REMARKS       debugging version since it only seems to work for small recordsets
;
;DEPENDENCIES  WMI
;
;EXAMPLE       $events = GetEvents('Security',528)
;
;KIXTART BBS   not yet posted for general use
;

function GetEvents($eventlog, $eventid, optional $date, 
                   optional $computer, optional $username,
                   optional $password)

  dim $objLocator, $objWBEM, $objWMIResults
  dim $event, $wqlQuery, $resultcount
  dim $ticks, $queryticks

  ; check to see whether we're connecting to a local or remote eventlog
  $computer=trim($computer)
  select
  case $computer=@WKSTA
    $computer='.'
    $computer=@WKSTA
  case $computer
  case 1
    $computer='.'
    $computer=@WKSTA
  endselect

  ; check to see whether we're connecting to a valid eventlog
  if $eventlog<>'Application' and $eventlog<>'Security' and $eventlog<>'System'
    exit 2
  endif

  ; create locator object for credentialed connection to a remote computer
  $ticks = @TICKS
  $objLocator = CreateObject('WbemScripting.SWbemLocator')
  $ticks = @TICKS - $ticks
  ? 'Execution time [ms] : '+$ticks+' for CreateObject("WbemScripting.SWbemLocator")'
  if @ERROR
    ? ''+@ERROR+' - '+@SERROR
    exit @ERROR
  endif

  if $username and $computer<>@WKSTA and $computer<>'.'
    ; create an credentialed connection to a remote computer
    ? 'Remote credentialed connection to '+$computer+' for '+$username+' and password '+$password
    $ticks = @TICKS
    $objWBEM=$objLocator.ConnectServer($computer,,$username,$password)
    $ticks = @TICKS - $ticks
    ? 'Execution time [ms] : '+$ticks+' for $objLocator.ConnectServer($computer,,$username,$password)'
    if @ERROR
      ? ''+@ERROR+' - '+@SERROR
      exit @ERROR
    endif

  else
    ; create an non-credentialed connection to a lcoal or remote computer
    ? 'Non-credentialed connection to '+$computer
    $ticks = @TICKS
    $objWBEM=$objLocator.ConnectServer()
    $ticks = @TICKS - $ticks
    ? 'Execution time [ms] : '+$ticks+' for $objLocator.ConnectServer()'
    if @ERROR
      ? ''+@ERROR+' - '+@SERROR
      exit @ERROR
    endif

  endif

  ; set the impersonation level
  $ticks = @TICKS
  $objWBEM.Security_.ImpersonationLevel = 3
  $ticks = @TICKS - $ticks
  ? 'Execution time [ms] : '+$ticks+' for $objWBEM.Security_.ImpersonationLevel = 3'
  if @ERROR
    ? ''+@ERROR+' - '+@SERROR
    exit @ERROR
  endif

  ; set the impersonation level and make sure we have backup and security permissions
  $ticks = @TICKS
  $objWBEM=GetObject('winmgmts:{impersonationLevel=impersonate, 
                    (Backup, Security)}!//'+$computer)
  $ticks = @TICKS - $ticks
  ? 'Execution time [ms] : '+$ticks+' for GetObject("winmgmts:{impersonationLevel=impersonate, 
                                                   (Backup, Security)}!//"+$computer))'
  if @ERROR
    ? ''+@ERROR+' - '+@SERROR
    exit @ERROR
  endif

  ; check to see whether we're looking for an event ID or if there's a custom query
  if instr($eventid,'select')
  else
    $eventid=val($eventid)
    $wqlQuery="SELECT * FROM Win32_NTLogEvent WHERE Logfile='"+$eventlog+"' AND EventCode="+$eventID
  endif

  ? 'Executing query: '+$wqlQuery
  $ticks = @TICKS
  $objWMIResults = $objWBEM.ExecQuery($wqlQuery)
  $ticks = @TICKS - $ticks
  $queryticks = $ticks
  ? 'Execution time  [ms]: '+$ticks+' for $objWBEM.ExecQuery($wqlQuery)'

  if @ERROR
    ? ''+@ERROR+' - '+@SERROR
    exit @ERROR
  endif

  $ticks = @TICKS
  $resultcount = $objWMIResults.Count
  $ticks = @TICKS - $ticks
  ? 'Execution time [ms] : '+$ticks+' for $objWMIResults.Count'


  ? 'Time for query  [ms]: '+$queryticks
  if $objWMIResults.Count
    ? 'Time per record [ms]: '+(CDBL($queryticks)/$resultcount)
  endif

  ? 'Resultset count     : '+$resultcount

;  for each $event in $objWMIResults
;    ? 'Category         = '+$event.Category
;    ? 'CategoryString   = '+$event.CategoryString
;    ? 'ComputerName     = '+$event.computerName
;    ? 'Data             = '+$event.Data
;    ? 'EventCode        = '+$event.EventCode
;    ? 'EventIdentifier  = '+$event.EventIdentifier
;    ? 'EventType        = '+$event.EventType
;    ? 'InsertionStrings = '+join($event.Insertionstrings,' - ')
;    ? 'Logfile          = '+$event.Logfile
;    ? 'Message          = '+join(split($event.Message,@CRLF),' - ')
;    ? 'RecordNumber     = '+$event.RecordNumber
;    ? 'Source Name      = '+$event.SourceName
;    ? 'TimeGenerated    = '+$event.TimeGenerated
;    ? 'TimeWritten      = '+$event.TimeWritten
;    ? 'Type             = '+$event.Type
;    ? 'User             = '+$event.User
;  next
;  ? 'Resultset count: '+$objWMIResults.Count

  $objWMIResults = 0
  $objWBEM = 0
  $objLocator = 0
  $GetEvents = $event
endfunction

---