Hi,

   I have turned on auditing for MSACCESS.EXE so that when Access is opened and closed, a Security Log is generated (592 for open, and 593 for closed.)

   I want to read the log and find out how often and how long Access is used, in this example. The Message part of the log is returned and looks like this:

'=================================
A new process has been created:

    New Process ID: 15744

    Image File Name: C:\Program Files\Microsoft Office\Office10\MSACCESS.EXE

    Creator Process ID: 3704

    User Name: username

    Domain: domainname

    Logon ID: (0x0,XXXXXXXX)
'===========================================

However, when I assign this message to a variable and try to find MSACCESS.EXE in the variable, I get a 0 (string not found).

Here is the code I am using.
'================================================= =========
strComputer = "."

Set objWMIService = GetObject("winmgmts:{impersonationLevel = impersonate, (Security)}!\\" & _
    strComputer & "\root\cimv2")
Set colLoggedEvents = objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent WHERE LogFile = 'Security'")
For Each objEvent in colLoggedEvents
    If objEvent.EventCode = 592 Or objEvent.EventCode = 593 Then
        strMessage = objEvent.Message
        strApp = "MSACCESS.EXE"
        strYes = InStr(strApp, strMessage)
        If strYes <> 0 Then
            WScript.Echo strMessage
        End If
    End If
Next
'================================================= ===
When I remove the conditonals and just display the messages, everything works fine. When I try to parse the messages, I get nothing.

What am I doing wrong?

Thanks,


mmcdonal

__________________
mmcdonal

Look it up at: http://wrox.books24x7.com

Sorry, I found it faster than the posts again:

From the MS Scripting Center:

InStr Function Example
This example uses the InStr function to return the position of the first occurrence of one string within another.

Dim SearchString, SearchChar, MyPos
SearchString ="XXpXXpXXPXXP" ' String to search in.
SearchChar = "P" ' Search for "P".

' A textual comparison starting at position 4. Returns 6.
MyPos = Instr(4, SearchString, SearchChar, 1)

' A binary comparison starting at position 1. Returns 9.
MyPos = Instr(1, SearchString, SearchChar, 0)

' Comparison is binary by default (last argument is omitted).
MyPos = Instr(SearchString, SearchChar) ' Returns 9.

MyPos = Instr(1, SearchString, "W") ' Returns 0.

I had the syntax backwards.

It is "strYes = InStr(strMessage, strApp)"
Not "strYes = InStr(strApp, strMessage)"




mmcdonal