title: WMI Query - 2008 Performace counters alerts
body: <p>I have a set of performance counters alerts on windows 2008 server, which I configured to write in the Event Viewer once the alert is fired.</p>
  
  <p>It does write in this event viewer "Applications and Services Logs/Microsoft/Windows/Diagnosis-PLA/Operational"</p>
  
  <p>I am trying to write a WMI query, in vbscript file, against this event viewer to read the events there.</p>
  
  <p>Here is my query:</p>
  
  <pre><code>Set objWMIService = GetObject("winmgmts:" _
      &amp; "{impersonationLevel=impersonate}!\\" &amp; strComputer &amp; "\root\cimv2")
  
  Set colItems = objWMIService.ExecQuery("select * from Win32_NtLogEvent where Logfile = 'Microsoft-Windows-Bits-Client%4Operational'")
  </code></pre>
  
  <p>The problem is: when I check colItems.count, it returns zero, however I know that there are events there, I can see them when I navigate to the event viewer.</p>
  
  <p>The same query works fine if I query the 'Application' event viewer:</p>
  
  <pre><code>Set colItems = objWMIService.ExecQuery("select * from Win32_NtLogEvent where Logfile = 'Application'")
  </code></pre>
  
  <p>It returns the count correctly.</p>
  
  <p>Any idea what the problem is in the first query?</p>