Slow WMI Select Query

2 Jun 2005 5:50 PM

Bob Smith

Hi,

I was wondering if someone could help me streamline my Select statement. It
works but the query is slow. The script connects to the Event Log and returns
2 event ID's from the date range (dtmStartDate - dtmEndDate). I then cycle
through each returned event and collect it's information (code not shown).

objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent Where
Logfile='Security' and TimeWritten >= '" & dtmStartDate & "' and TimeWritten
< '" & dtmEndDate & "' and Eventcode='569' Or Logfile='Security' and
TimeWritten >= '" & dtmStartDate & "' and TimeWritten < '" & dtmEndDate & "'
and Eventcode='643'", "WQL",wbemFlagReturnImmediately + wbemFlagForwardOnly)

Thanks

2 Jun 2005 6:21 PM

Veign

From a post by Jeff Johnson:

"You have posted this question individually to
multiple groups. This is called Multiposting
and it's BAD. Replies made in one group will
not be visible in the other groups, which
may cause multiple people to respond to your
question with the same answer because they
didn't know someone else had already done it.
This is a waste of time.

If you MUST post your message to multiple
groups, post a single message and select all
the groups (or type their names manually,
separated by commas) in which you want it to
be seen. This is called Crossposting and when
used properly it is GOOD."

--
Chris Hanscom - Microsoft MVP (VB)
Veign's Resource Center
http://www.veign.com/vrc_main.asp
--
Read. Decide. Sign the petition to Microsoft.
http://classicvb.org/petition/

Show quoteHide quote

"Bob Smith" <BobSm***@discussions.microsoft.com> wrote in message
news:35AC290D-D59D-4F82-A046-29B7A162A78C@microsoft.com...
> Hi,
>
> I was wondering if someone could help me streamline my Select statement.
It
> works but the query is slow. The script connects to the Event Log and
returns
> 2 event ID's from the date range (dtmStartDate - dtmEndDate). I then cycle
> through each returned event and collect it's information (code not shown).
>
> objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent Where
> Logfile='Security' and TimeWritten >= '" & dtmStartDate & "' and
TimeWritten
> < '" & dtmEndDate & "' and Eventcode='569' Or Logfile='Security' and
> TimeWritten >= '" & dtmStartDate & "' and TimeWritten < '" & dtmEndDate &
"'
> and Eventcode='643'", "WQL",wbemFlagReturnImmediately +
wbemFlagForwardOnly)
>
> Thanks
>

2 Jun 2005 7:01 PM

Zoury

Hi Bob !

> SELECT * FROM

Avoid using the * in a SQL query. This makes the system lookup the columns
for you (which cost time) and the fact it returns all the fields can
dramatically slow things down. Query only the fields you actually need.

I also seem to recall that WMI is known to be quite slow.. so how slow is
your query running ?

one other thing :

> wbemFlagReturnImmediately + wbemFlagForwardOnly

When dealing with flag constants you should always use OR instead of + :
'***
wbemFlagReturnImmediately OR wbemFlagForwardOnly
'***

Hope this helps

--
Best Regards
Yanick

2 Jun 2005 8:07 PM

Bob Smith

takes 5 minutes for a 16mb log file.

Thanks I will try that so see how it goes.

Show quoteHide quote

"Zoury" wrote:

> Hi Bob !
>
> > SELECT * FROM
>
> Avoid using the * in a SQL query. This makes the system lookup the columns
> for you (which cost time) and the fact it returns all the fields can
> dramatically slow things down. Query only the fields you actually need.
>
> I also seem to recall that WMI is known to be quite slow.. so how slow is
> your query running ?
>
> one other thing :
> > wbemFlagReturnImmediately + wbemFlagForwardOnly
>
> When dealing with flag constants you should always use OR instead of + :
> '***
> wbemFlagReturnImmediately OR wbemFlagForwardOnly
> '***
>
> Hope this helps
>
> --
> Best Regards
> Yanick
>
>
>