VB Forum / General / June 2005

Hi Bob ! :O)

well... it kinda seems to be normal since you do run the query 120 times
over a network.. :O)

There should be no need to specify these filters twice :
   Logfile='Security' and
   TimeWritten >= '" & dtmStartDate & "' and
   TimeWritten < '" & dtmEndDate & "'

You can use parenthetical subexpressions like this :
Set colItems = objWMIService.ExecQuery( _
"SELECT InsertionStrings, " & _
               "Eventcode, " & _
               "TimeWritten " & _
"FROM Win32_NTLogEvent " & _
"Where Logfile='Security' and " & _
           "TimeWritten >= '" & dtmStartDate & _"' and " & _
           "TimeWritten < '" & dtmEndDate & "' and " & _
           "(Eventcode='123' Or Eventcode='456')", _
   "WQL", _
   wbemFlagReturnImmediately Or wbemFlagForwardOnly)

I doubt it will change something though.. i've got the feeling that the WQL
parser did not apply these filters twice will processing the query..

and btw, although in this case it didn't change anything, the folowing
statement :
wbemFlagReturnImmediately + wbemFlagForwardOnly

should really be :
wbemFlagReturnImmediately Or wbemFlagForwardOnly

Since it's a flag value (bitmask). ie. (1 + 3) <> (1 Or 3), right ?