' Define constants and enumeration values. 

'******** REPLACE THIS PORTION WITH YOUR ACTUAL DATA *******************************
Const logDate = #12/31/2008 11:59:59 PM# 
Const clientUserName = "MYCOMPANY\staff1"
Const STEP = 10 ' the step at which progress is written into the Windows event log
'******** REPLACE THIS PORTION WITH YOUR ACTUAL DATA *******************************

Const protocol = "HTTP" 

Const records = 5000 
Const Error_FileNotFound = &H80070002 
Const fpcLogViewerFilter = 2 

Const lowIp = "1.0.0.1" 
Const excludedCode = 401 

Const fpcFilterByClientIP = 1 
Const fpcFilterByClientUserName = 2
Const fpcFilterByProtocol = 10 
Const fpcFilterByLogTime = 18 
Const fpcFilterByLogType = 23 
Const fpcFilterByResultCode = 37 
Const fpcEqual = &H000000001 
Const fpcNotEqual = &H000000002 
Const fpcGreaterOrEqual = &H000000004 
Const fpcProxyFwLog = &H000000002 
Const fpcProxyWebLog = &H000000001
Const fpcLastHour = &H00000100
Const fpcLast30days = &H00000800

'Declare the other objects needed. 
Dim args ' A WScript Arguments object 
Dim outFileName ' A String 
Dim outFile ' A TextStream object 
Dim fso ' A FileSystem object 
Dim root ' The FPCLib.FPC root object 
Dim isaArray ' An ISA Server array object 
Dim filter ' An FPCFilterExpressions collection 
Dim log ' An FPCLogContent collection 
Dim entry ' An FPCLogEntry object 

' Find out if the user wants the output on the screen or in a text file. 

Set args = WScript.Arguments 
If args.Count = 1 Then 
  Set fso = CreateObject("Scripting.FileSystemObject") 
  outFileName = args.Item(0) 
  Set outFile = fso.CreateTextFile(outFileName, True) 
  Set fso = Nothing 
Else 
  Set outFile = WScript.StdOut 
End If 

' Create the root object. 
Set root = CreateObject("FPC.Root") 

' Get references to the array object and the MSDE log content collection. 
Set isaArray = root.GetContainingArray 
Set log = isaArray.LogViewer.LogContentMSDE 
WScript.Echo "The MSDE log content collection has been retrieved." 
LogAnEvent "LogQuery: The MSDE log content collection has been retrieved." 

' Create an FPCFilterExpressions collection. 
Set filter = CreateObject("FPC.FPCFilterExpressions") 
filter.FilterType = fpcLogViewerFilter 
WScript.Echo "The filter object has been created." 
LogAnEvent "LogQuery: The filter object has been created." 

On Error Resume Next 

' filter.AddDateFilter fpcFilterByLogTime, fpcLastHour, logDate 

filter.AddDateFilter fpcFilterByLogTime, fpcLast30days, logDate 
CheckError 

filter.AddEnumFilter fpcFilterByLogType, fpcEqual, fpcProxyWebLog 
CheckError 

filter.AddIPAddressFilter fpcFilterByClientIP, fpcGreaterOrEqual, lowIp 
CheckError 

filter.AddNumericFilter fpcFilterByResultCode, fpcNotEqual, excludedCode 
CheckError 

filter.AddStringFilter fpcFilterByClientUserName, fpcEqual, clientUserName 
CheckError 

filter.AddStringFilter fpcFilterByProtocol, fpcEqual, protocol 
CheckError 

log.ExecuteQuery filter, records 

WScript.Echo "Executing the log query..." 
LogAnEvent "LogQuery: Executing the log query..." 

Dim Index 
Index = 1 

outFile.WriteLine("Date and Time" & vbTab & "Client IP" & vbTab & _ 
  "User Name" & vbTab & "Destination" )

On Error Resume Next 

Do 
  if (Index-1) mod STEP = 0 then
    LogAnEvent "LogQuery: " & (Index-1) & " log entries has been retrieved."
  end if

  Set entry = log.Item(Index) 
  ' A File_Not_Found (0x80070002) error is raised when the index points 
  ' beyond the end of the log content collection. 

  If Err.Number = Error_FileNotFound Then 
    WScript.Echo "All existing entries have been retrieved." 
    LogAnEvent "LogQuery: All existing entries have been retrieved." 
    Exit Do 
  End If 

  outFile.WriteLine(entry.LogTime & vbTab & entry.ClientIP & vbTab & _ 
    entry.clientUserName & vbTab & entry.DestHost )


  Index = Index + 1 
Loop Until Err.Number <> No_Error 

Err.Clear 

Sub CheckError() 

  If Err.Number <> 0 Then 
    WScript.Echo "An error occurred: 0x" & Hex(Err.Number) & " " & _ 
    Err.Description 
    Err.Clear 
  End If 
End Sub 

Sub LogAnEvent(em)
  set obj = CreateObject("wscript.shell")
  obj.LogEvent 0, em
End Sub