Question

我正在编写一个脚本来将事件日志信息写入csv。我的剧本以前工作过。但我改变了一些东西，这对写入csv不应该有任何影响。根据我在互联网上就此问题所做的一些研究，我尝试过写入unicode和ASCII。两者都没有区别。奇怪的是我稍后在我的脚本中使用相同的代码来编写其他日志（我首先编写系统日志，然后编写应用程序日志等），并且它在那里工作得很好。我使用的代码是临时的，因为我没有编写一种方法来删除消息中的回车（这会导致将CSV导入Excel时出现问题）。因此，一旦我这样做，它可能会自行解决。但似乎这是一个比这更大的问题。这是脚本，直到它转移到其他日志：

Set wshShell = WScript.CreateObject( "WScript.Shell" )
strComputerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )

strComputer = "."
strType = "Error"
strPath = "T:\IT resources\Event Logs\ErrorLog" & strComputerName & ".csv"

'Script to convert UTC to human readable. From Script Repository.

Function WMIDateStringToDate(dtmInstallDate)
    WMIDateStringToDate = CDate(Mid(dtmInstallDate, 5, 2) & "/" & _
        Mid(dtmInstallDate, 7, 2) & "/" & Left(dtmInstallDate, 4) _
            & " " & Mid (dtmInstallDate, 9, 2) & ":" & _
                Mid(dtmInstallDate, 11, 2) & ":" & Mid(dtmInstallDate, _
                    13, 2))
End Function

'ForWriting is to write to file from start. ForAppending is to write to file from end of file.

constForWriting = 2
constForAppending = 8
constTristate = 0
boolUnicode = False
chrCarriageReturn = chr(13)
chrNewLine = chr(10)

Set objFSO = CreateObject("Scripting.FileSystemObject")


'This is so that cscript won't encounter a runtime error if the file already exists. Also so that it will write to the already existing file.

If objFSO.FileExists(strPath)=False Then

 Set objErrLog = objFSO.CreateTextFile(strPath,constForWriting,boolUnicode)
  objErrLog.Write "Type,"
  objErrLog.Write "Time Generated,"
  objErrLog.Write "Source Name,"
  objErrLog.Write "Event Code,"
  objErrLog.Write "Category,"
  objErrLog.Write "Message"
  objErrLog.Writeline
 strTimeMin = "01/01/1970/0:00:00"
'19700101000000.000000-480

 Else Set objErrLog = objFSO.OpenTextFile(strPath,constForAppending,constTristate)

'Only need this if it writes from the line the file ends on, as opposed to starting on a new line (which I expect it will).

  objErrLog.WriteLine

End If

Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

'Querying Event Logs

Set colLoggedEvents = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_NTLogEvent WHERE Logfile = 'system' AND "_
 & "Type = 'Error'")

'Type='Error' instead of "1" because it is a WQL query, I think. I believe that it is searching the entries in a database that reference the Win32_NTLogEvent objects. So I am searching the values in the database as opposed to the properties of the objects they reference. Or perhaps not. WHen I echo the type property of every object in colLoggedEvents, cscript outputs "Error". So maybe the I'm reading the SDK wrong? At least it seems to be working.

'This is a comparison function which tells where string 2 occurs in string 1. Starts at 1.

constStart = 1
constCompareType = 0

'This loop writes the information to a .csv.

For Each objEvent In colLoggedEvents

 If objEvent.Timegenerated > strTimeMin Then
  strTimeMin = objEvent.TimeGenerated
 Else
 End If
 objErrLog.Write objEvent.Type & ","
 objErrLog.Write WMIDateStringToDate(objEvent.TimeGenerated) & ","
 objErrLog.Write objEvent.SourceName & ","
 objErrLog.Write objEvent.EventCode & ","

 constExist=InStr(constStart,objEvent.Message,chrCarriageReturn,constCompareType)+InStr(constStart,objEvent.Message,chrNewLine,constCompareType)

  If constExist = 0 Then
   objErrLog.Write objEvent.Category & ","
   objErrLog.Write objEvent.Message

  Else
   objErrLog.Write objEvent.Category

  End If

 objErrLog.WriteLine

Next

非常感谢任何帮助。

Answer 1

忽略了代码＆＃39;可能自行解决的误解
在提问时提供完整的错误详情（编号，描述，标识行）
假设您有一个＆＃34; 5 - 无效的过程调用或参数＆＃34;以＆＃34; objErrLog.Write＆＃34;开头的行上的错误请参阅here以获取解释。
您声称已使用Unicode测试了代码的变体;你没有，因为：

.CreateTextFile的原型是

object.CreateTextFile(filename:string[, overwrite:bool[, unicode:bool]])

这与您的

objFSO.CreateTextFile(strPath,constForWriting,boolUnicode)

.OpenTextFile的原型是

object.OpenTextFile(filename:string[, iomode:enum[, create:bool[, format:enum]]])

这与您的

objFSO.OpenTextFile(strPath,constForAppending,constTristate)

所以修复这些错误（你自己！），测试真正为Unicode打开的文件，并希望假设（3）成立。

更新wrt评论：

请反思＆＃34; 在提问时提供完整的错误详情（编号，描述，标识行）＆＃34;在以下情况下：

我在colLoggedEvents的68个成员后得到一个无效的过程错误当我有ASCII文件时。

VS

当我调用OpenTextFile方法时，我收到错误

第一个语句暗示第68个成员包含无法以ASCII / ANSI模式写入的字符。 真正/正确使用Unicode输出格式将解决问题，前提是错误日志不包含无效数据。

第二个语句表明.Open / CreateTextfile方法的参数仍然不正确。您是否将这两个调用都更改为Unicode？

更新II：

文档定义

TristateTrue -1将文件打开为Unicode。

您的代码错误地使用了：

constTristate = 1 
Set objErrLog = objFSO.OpenTextFile(strPath,constForAppending,boolCreate,constTristate)

证据：

>> Set ts = goFS.OpenTextFile("error5.txt", 8, False, 1)
>>
Error Number:       5
Error Description:  Invalid procedure call or argument
>> Set ts = goFS.OpenTextFile("error5.txt", 8, False, -1)
>>
>> <-- no news are good news

更新有关TriStateTrue的评论：

VBScript doc说：

TristateUseDefault -2 Opens the file using the system default.
TristateTrue       -1 Opens the file as Unicode.
TristateFalse       0 Opens the file as ASCII.

doc @Adam提到了VBA;但我不会在没有支票的情况下相信它。

Win32_NTLogEvent消息属性FilSystemObject.Write过程调用问题

1 个答案: