Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working write now to get events, using WMI.

i tried to get the event using the where clause as
WHERE LogFile='Security' AND EVENTIDENTIFIER='someevent'

what difference does it make, it i try with
WHERE EVENTIDENTIFIER='someevent'

which is good to use and why.?

Thanks,

share|improve this question

closed as not a real question by Chopper3, MDMarra, RobM, Dave M, Khaled Jun 30 '12 at 7:17

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
Please proofread your questions before you click the submit button. This is unintelligible. –  MDMarra Jun 29 '12 at 11:52
    
@Sandeep I tried to fix your formatting. Please correct it if I messed up the syntax you were intending to enter. –  squillman Jun 29 '12 at 12:21

1 Answer 1

In the former case you are explicitly filtering by Log Type (Security) and an Event ID. In the latter case you are just filtering by Event ID, which obviously does not have to be unique among different log types. But since you are not filtering by Event Source as well, your results are going to be ambiguous in both cases.

share|improve this answer
    
if i am not wrong, event ids are unique for event type, so is there any chance that there can be one event id for two different kind of events in different log file.? –  Sandeep Jun 29 '12 at 13:49
    
@sandeep Event IDs are not unique: social.msdn.microsoft.com/Forums/en/etw/thread/… –  the-wabbit Jun 29 '12 at 14:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.