query in Win32_NTLogEvent to read records

Abdalla Omran

I am reading from Win32_NTLogEvent to read events from today with EventIdentifier 307 and 800 and save them in DB and this part is working fine but what i am trying to do is when the job is breaking down then i am getting the last record saved in DB and want to continue read the data which is bigger as last record which is in datatime but it doesnt work and its getting the whole data once again.

What I tried until now :

where: date is the last TimeWritten in DB

want: to continue read greater than last TimeWritten in DB

 queryString = $"SELECT * FROM Win32_NTLogEvent where logfile = 'Microsoft-Windows-PrintService/Operational' and TimeWritten > '{date}' and EventIdentifier = 307 or EventIdentifier = 800";

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Abdalla Omran4y ago
I am getting an exception for both of the queries so maybe to make more clear i am not reading direct from DB i am reading from wmi query(its an event logs from Printer Service ) so the steps are like that :

1 - read with this query SELECT * FROM Win32_NTLogEvent where logfile = 'Microsoft-Windows-PrintService/Operational' and TimeWritten > '{dateTime}' and EventIdentifier = 307 or EventIdentifier = 800

2- if the job stoped and should to continue reading so it should read from the last record that has already saved in DB for example - read > 5.11.2021 11:49:23
Sachin Singh4y ago
ok, it means the MAX is always max so you must be getting zero records from database, so instead of max use second max value.
SELECT MAX(col) FROM table WHERE col NOT IN (SELECT MAX(col) FROM table);

queryString = $"SELECT * FROM Win32_NTLogEvent where logfile = 'Microsoft-Windows-PrintService/Operational'
and (EventIdentifier = 307 or EventIdentifier = 800) and TimeWritten >
(SELECT MAX(TimeWritten) FROM Win32_NTLogEvent WHERE
TimeWritten
NOT IN (SELECT MAX(
TimeWritten
) FROM Win32_NTLogEvent);
Abdalla Omran4y ago
It doesn't work . something is wrong .. could you check it again please

Sachin Singh4y ago

use this

queryString = $"SELECT * FROM Win32_NTLogEvent where logfile = 'Microsoft-Windows-PrintService/Operational' 
and (EventIdentifier = 307or EventIdentifier = 800) and TimeWritten > 
(select MAX(TimeWritten) from Win32_NTLogEvent group by logfile);