title: C# WMI reading remote event log
body: <p>Im trying to run a WMI query against another computer for errors within the last 5 hours or so.  When running a WMI query, shouldnt you at least filter the initial query with a where clause?  </p>
  
  <p>Im basing my code off of samples generated from the WMI code creator on MSDN</p>
  
  <p>Here is the select query im using</p>
  
  <pre><code>    private ManagementScope CreateNewManagementScope(string server)
      {
          string serverString = @"\\" + server + @"\root\cimv2";
  
          ManagementScope scope = new ManagementScope(serverString);
  
          return scope;
      } 
  
              ManagementScope scope = CreateNewManagementScope(servername);
              scope.Connect();
              SelectQuery query = new SelectQuery("select * from Win32_NtLogEvent where TimeWritten &gt; '" + DateTime.Now.AddHours(-5).ToString() + "'");
              ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query);
              ManagementObjectCollection logs = searcher.Get();
  
              int iErrCount = logs.Count;
  </code></pre>
  
  <p>I just want to get a count of the errors in the last 5 hours.  Its throwing an error when getting the count.  The error is rather vague "Generic Failure".</p>
  
  <p>[update - using date like this now]</p>
  
  <pre><code>                DateTime d = DateTime.UtcNow.AddHours(-12);
              string dateFilter = ManagementDateTimeConverter.ToDmtfDateTime(d);
              SelectQuery query = new SelectQuery("select * from Win32_NtLogEvent where Logfile='Application' AND Type='Error' AND TimeWritten &gt; '" + dateFilter + "'");
  </code></pre>
  
  <p>With the above code I get no results, yet I can see 2 errors in the event log.  Whats wrong with the date filter?</p>
  
  <p>Im using this example 
  <a href="http://msdn.microsoft.com/en-us/library/system.management.managementdatetimeconverter.todatetime.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/system.management.managementdatetimeconverter.todatetime.aspx</a></p>