When querying the Win32_NTLogEvent Class from WMI with WQL is the TimeGenerated property based on Lo
Posted
by jpmcclung
on Stack Overflow
See other posts from Stack Overflow
or by jpmcclung
Published on 2010-06-17T15:47:47Z
Indexed on
2010/06/17
15:53 UTC
Read the original article
Hit count: 845
I am writing a C# windows service that is doing some churning through the eventlog on a few domain controllers. Some of them are Windows Server 2003 and some are Windows Server 2008. Upon the service stopping I am attempting to resume where I left off in the logs. In order to do this instead of
SELECT * FROM Win32_NTLogEvent WHERE --criteria for events I am looking for
I am doing
SELECT * FROM Win32_NTLogEvent WHERE TimeGenerated = --some date AND --criteria for events I am looking for
At one point I was convinced that the TimeGenerated field was in the local time of the server but now it seems that the Windows 2008 Servers are using GMT to record that time. Can anyone shed some light on if this is a real different between the way the two operating systems function or is this a configuration problem?
© Stack Overflow or respective owner
