markabrand affrmwbpdhgmailcom lovely thanks 26032008 tim golden wrote markabrand wrote events example want return error warning events last 4 days logs getting events filtering terrribly slow let wmi filtering since nonequi filter want last 4 days youll pass wql still advantageous use wmi module even though youre producing query since wraps results _wmi_objects gives easy access properties methods etc import wmi import datetime five_days_ago datetimedatetoday datetimetimedelta 5 wmi_five_days_ago wmifrom_time five_days_agotimetuple 1 wql wont like line feeds strip later wql select win32_ntlogevent eventtype 1 eventtype 2 timegenerated wmi_five_days_ago c wmiwmi event cquery join wqlsplit print eventlogfile eventrecordnumber wmito_time eventtimegenerated theres slight messiness involved time aspects realise although wmi module couple helper functions to_time from_time dont actually play well datetime module still return recognisable tuple play ill try improve anyway tjg _______________________________________________ pythonwin32 mailing list kpitckaew45pythonorg httpmailpythonorgmailmanlistinfopythonwin32 thu 07 aug 2008 111342 1100 pythonwin32 wmi query