利用WMI 采集远程Windows 日志(应用、系统、安全)

四點壹木 1 Reputation point
2020-05-27T11:23:59.63+00:00

目前都已配置成功,但是有两个问题

  1. 问题一:WMI 采集远程Windows 日志(应用、系统、安全)是否可以通过Win32_NTLogEvent class 能够采集?
  2. 问题二:目前采用的WQL语句是:Select * from Win32_NTLogEvent WHERE Logfile ='system',但是发现跟windows 计算机管理-事件查看器中看到系统、应用、安全的日志数量不符。通过WMI采集的日志明显少于事件查看器中的日志
    请大佬们给与建议,谢谢!!!
Not Monitored
Not Monitored
Tag not monitored by Microsoft.
37,738 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Anonymous
    2020-05-27T12:05:34.97+00:00

    Win32 is not supported here on QnA. I'd try asking for help in dedicated forums here.

    https://social.msdn.microsoft.com/Forums/sqlserver/en-US/home?forum=windowsgeneraldevelopmentissues

    --please don't forget to Accept as answer if the reply is helpful--


    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    0 comments No comments