Windows XP vs Windows Server 2003


  • Hi,
    I ran a WMI script which involves Custom Event Logs in Windows XP. The Script is shown below. 

    strComputer = "."
    Set objWMIService = GetObject("winmgmts:{(Security)}\\" & _
            strComputer & "\root\cimv2")
    Set colMonitoredEvents = objWMIService.ExecNotificationQuery _    
        ("Select * from __InstanceCreationEvent Where " _
            & "TargetInstance ISA 'Win32_NTLogEvent' " _
     & "and TargetInstance.Logfile = 'RTAS_Log' ")
        Set objLatestEvent = colMonitoredEvents.NextEvent
        Wscript.Echo objLatestEvent.TargetInstance.User
        Wscript.Echo objLatestEvent.TargetInstance.TimeWritten
        Wscript.Echo objLatestEvent.TargetInstance.Message

    The script monitors the custom event log(RTAS_Log) for an event entry and the moment an event entry is made, it will be displayed. It works fine in Windows Xp. But not in Windows Server 2003 (i.e) the entry had been made in the Log but the script didn't sense it .
    I tried debugging by replacing the Custom Event Log by default one, Application Log and made an entry in that log. This time it worked fine. It seems that the problem should be some compatibility issue in Win 2k3 regarding Custom logs. Kindly suggest any solution.

    Thanks in advance,

    Thursday, May 14, 2009 4:33 AM


  • Hi,

    I changed TargetInstance.Logfile = 'RTAS_Log' to TargetInstance.Logfile = 'system', when I start or stop a service, it works fine on my Windows Server 2003 system.

    You may try to test in Clean Boot to narrow down the cause of this issue.
    1. Click Start, type "msconfig", press Enter.
    2. Switch to Services tab, click Hide all Microsoft services, click Disable all.
    3. Switch to Startup tab, click Disable All. Click OK.
    4. Restart and try again.

    If the issue persists, try to test on another Windows Server 2003 and help to collect MPS Report.

    A.  Download MPS Reporting Tool (MPSRPT_PFE.EXE) from the following link:

    Please note: The link may be truncated when you read the E-mail. Be sure to include all text between '(' and ')' when navigating to the download location.

    B . Right click MPSRPT_PFE.EXE and select Run as Administrator to run this tool, and you will see a Command Window start up.

    C . Please type Y with the message of <Include the MSINFO32 report? (defaults to Y in 15 seconds)[Y,N]?

    D . When the tool is done you will see an Explorer Window opening up the %systemroot%\MPSReports\Setup\Reports\cab folder and containing a <Computername> file. After collecting, please use Windows Live SkyDrive ( to upload the file and then give us the download address.


    This posting is provided "AS IS" with no warranties, and confers no rights.
    Friday, May 15, 2009 7:52 AM