Abdalla Omran

Abdalla Omran

  • NA
  • 334
  • 32k

query in Win32_NTLogEvent to read records

Nov 5 2021 8:46 AM

I am reading from Win32_NTLogEvent to read events from today with EventIdentifier 307 and 800 and save them in DB and this part is working fine but what i am trying to do is when the job is breaking down then i am getting the last record saved in DB and want to continue read the data which is bigger as last record which is in datatime but it doesnt work and its getting the whole data once again. 

What I tried until now :

where: date is the last TimeWritten in DB

want: to continue read greater than last TimeWritten in DB

 queryString = $"SELECT * FROM Win32_NTLogEvent where logfile = 'Microsoft-Windows-PrintService/Operational' and TimeWritten > '{date}' and EventIdentifier = 307 or EventIdentifier = 800";

 


Answers (4)