WMI query to write an event RRS feed

  • Question

  • Hi

    We have a WMI query script which will write a event ID 888 on “Application” Logs whenever it matches the configured thresholds. This is working fine as expected in all targeted 600 servers from many months,  but now the issue is our Windows team is asking us to write this event on "Operations Manager" (this in path Event Viewer - Applications and Service Logs - Microsoft ) logs instead of “Application” Logs as this script is deployed through SCOM.

     We tried to edit the line on this script by changing the text from “Application” to “Operations Manager” as below. But after changing this,  script is not writing the event 888 on “Operations Manager” logs whenever it matches the configured thresholds

     below is the line in that script which is initiating this event writing

    Set WshShell = WScript.CreateObject("WScript.Shell")

     strCommand = "eventcreate /T Error /ID 888 /L Application/D " & _

        Chr(34) & "Drive " & Device & " missing" & Chr(34)

    Can some one please help us by modifying this script so that it can write this event in Operations Manager log (Path : Event Viewer - Applications and Service Logs - Microsoft ) instead of "Application" logs

    • Moved by Bill_Stewart Tuesday, December 11, 2018 9:43 PM Abandoned
    Wednesday, August 1, 2018 7:25 AM

All replies

  • You have to use the full path to the log.  This an be copied from the log properties page in the event viewer.

    Microsoft-Windows-Operations Manager/Operational


    • Edited by jrv Wednesday, August 1, 2018 7:50 AM
    Wednesday, August 1, 2018 7:49 AM
  • Hi Properties its showing as below;

    Full Name : Operations Manager

    log path : %SystemRoot%\System32\Winevt\Logs\Operations Manager.evtx

    what we have put it here,,

    please refer the attached image;

    Wednesday, August 1, 2018 7:57 AM
  • Then the "eventcreate" cannot write to the extended logs.  You will have to use PowerShell to write to these logs.  One more reason why VBScript is obsolete.

     Get-WinEvent -ListLog *

    It is also possible that the log is protected and the command is returning an error. Most Microsoft logs do not allow writes except from registered apps.


    Wednesday, August 1, 2018 8:04 AM
  • Any solution so that we can make it to write on this extended logs?
    Wednesday, August 1, 2018 8:48 AM