When querying the Win32_NTLogEvent Class from WMI with WQL is the TimeGenerated property based on Lo
- by jpmcclung
I am writing a C# windows service that is doing some churning through the eventlog on a few domain controllers. Some of them are Windows Server 2003 and some are Windows Server 2008. Upon the service stopping I am attempting to resume where I left off in the logs. In order to do this instead of
SELECT * FROM Win32_NTLogEvent WHERE --criteria for events I am looking for
I am doing
SELECT * FROM Win32_NTLogEvent WHERE TimeGenerated = --some date AND --criteria for events I am looking for
At one point I was convinced that the TimeGenerated field was in the local time of the server but now it seems that the Windows 2008 Servers are using GMT to record that time. Can anyone shed some light on if this is a real different between the way the two operating systems function or is this a configuration problem?
