I want to tell you that I have a program in my toolbox that I generally use to get information about the running services from a remote computer via WMI. It is written in ASP.Net/C#.

But that’s not what this is all about.

All of a sudden it broke down and did not work anymore. Result: Today I have been staring at this line of text just below for about two whole hours, trying to understand why it was generating an Invalid Query exception.

QueryString = "Select * from Win32_NTLogEvent WHERE LogFile='Application' AND SourceName='Outlook' AND TimeGenerated > '31/05/2012 05:15:52'"

It looks tame enough, but it does not work. The problem was that WMI expects the dates to be in the reversed US of A format. I always knew this was the case for SQL Server, but alas I did not make the connection with WMI. If you pass the date in a different format it will not work, so you will need to change its format before passing the request to the server. This code snippet shows you one way how it can be done.

This declaration goes at the top:

using System.Management;

and this here is the fixed code:

ManagementScope scope = new ManagementScope("\\\\" + address + "\\root\\cimv2");

ObjectQuery wql = new ObjectQuery(@"Select * from Win32_NTLogEvent WHERE LogFile='Application' AND SourceName='Outlook' AND TimeGenerated > '" + DateTime.Now.AddHours(-threshold1).ToString("MM/dd/yyyy HH:mm") + "'");

ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, wql);

ManagementObjectCollection results = searcher.Get();

foreach (ManagementObject result in results)
    // do something interesting

In the above code, address and threshold1 are two variables that respectively hold the name of the computer that you want to check and the time range from which you want to get the events.

Incidentally, only now do I remember that I have changed the regional settings on my computer from US to UK a couple of days ago.


Add your comments