{"id":202914,"date":"2013-12-04T10:22:03","date_gmt":"2013-12-04T06:22:03","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=202914"},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-29T21:00:00","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=202914","title":{"rendered":"<span class=\"post_title\">\u041e\u0442\u0447\u0451\u0442 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439<\/span>"},"content":{"rendered":"<div class=\"content html_format\">   \t\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!<br \/>  \u041e\u0442\u0447\u0451\u0442 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0430 \u0441\u0432\u043e\u0451\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435, \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u0435\u043d. \u0421 \u043c\u043d\u043e\u0433\u0438\u0445 \u0442\u043e\u0447\u0435\u043a \u0437\u0440\u0435\u043d\u0438\u044f. \u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. <br \/>  \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0445\u0440\u0430\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u0440\u0435\u0434\u0430 Windows. \u0412 \u0418\u043d\u0435\u0442\u0435 \u0433\u043e\u0442\u043e\u0432\u043e\u0433\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043d\u0435 \u043d\u0430\u0448\u0451\u043b, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0441\u0434\u0435\u043b\u0430\u043b \u0441\u0432\u043e\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e.<br \/>  \u0421\u043a\u0440\u0438\u043f\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435 \u0438\u043c\u0435\u0435\u043c \u043d\u0430\u0431\u043e\u0440 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.<br \/>  \u041a\u0430\u0440\u0442\u0438\u043d\u043a\u0430 \u0434\u043b\u044f \u043f\u0440\u0438\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f:<br \/>  <img decoding=\"async\" src=\"http:\/\/habr.habrastorage.org\/post_images\/155\/a2c\/8a1\/155a2c8a1d1b836b72d51769a2c1191d.png\"\/><br \/>  <a name=\"habracut\"><\/a><br \/>  \u041e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0438\u0434\u0435\u044f \u0442\u0430\u043a\u0430\u044f. \u0422\u0435\u043a\u0443\u0449\u0438\u0435 \u0441\u043e\u0431\u044b\u0442\u0438\u044f \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u0432 evt-\u0444\u0430\u0439\u043b\u0435 \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435. \u0424\u0430\u0439\u043b \u043a\u043e\u043f\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440, \u0433\u0434\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0438\u0437 \u043d\u0435\u0433\u043e \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u043d\u0430 SQL Server. \u0417\u0430\u0442\u0435\u043c SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u043c \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043e\u0442\u0447\u0451\u0442 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0444\u0430\u0439\u043b.<br \/>  \u0422\u0435\u043f\u0435\u0440\u044c, \u043a\u0430\u043a \u044d\u0442\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043e.<br \/>  \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u043f\u0430\u043f\u043a\u0438 Log, Logs, CheckComps, Logi_ForReports \u0438 Computer. \u0423 \u043c\u0435\u043d\u044f \u043f\u0430\u043f\u043a\u0438 \u043d\u0430 \u0434\u0438\u0441\u043a\u0435 F. \u0412 \u043f\u0430\u043f\u043a\u0435 Log \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0439\u043b list.txt \u0441\u043e \u0441\u043f\u0438\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c. \u041a\u0430\u0436\u0434\u043e\u0435 \u0438\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u0441 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438. \u042f \u0441\u043e\u0437\u0434\u0430\u043b 2 \u0444\u0430\u0439\u043b\u0430 list.txt \u0438 list7.txt \u0434\u043b\u044f XP \u0438 \u0441\u0435\u043c\u0451\u0440\u043e\u043a \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0435\u043d\u043d\u043e. \u0412 \u043f\u0430\u043f\u043a\u0435 Computer \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0430\u0439\u043b is_computer_online_listComps.vbs  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">\u0421\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0444\u0430\u0439\u043b\u0430 is_computer_online_listComps.vbs:<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"vbscript\">on error resume next  dim gsFileName dim gsRunCmd dim gix dim giy dim giz  if Wscript.Arguments.Count = 1 then \tgsFileName = Wscript.Arguments(0) \tgsOS = &quot;XP&quot; elseif Wscript.Arguments.Count = 2 then \tgsFileName = Wscript.Arguments(0) \tgsOS = Wscript.Arguments(1) else \tgsFileName = InputBox(&quot;\u0424\u0430\u0439\u043b \u0441\u043e \u0441\u043f\u0438\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432&quot;, &quot;\u0412\u0432\u043e\u0434&quot;, &quot;F:\\Log\\list.txt&quot;) \tgsOS = InputBox(&quot;\u0422\u0438\u043f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b:&quot; & VBNewLine & &quot;'XP' - \u0434\u043b\u044f Windows 2000\/XP&quot; & VBNewLine & &quot;'7' - \u0434\u043b\u044f Windows 7&quot;, &quot;\u0412\u0432\u043e\u0434&quot;, &quot;XP&quot;) end if  gsOS = uCase(gsOS) wscript.echo &quot;gsOS: &quot; & gsOS if inStr(gsOS, &quot;XP&quot;) = 0 and inStr(gsOS, &quot;7&quot;) = 0 then \tMsgBox &quot;\u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u0443\u043a\u0430\u0437\u0430\u043d \u0442\u0438\u043f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b!&quot;, vbInformation, &quot;\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435&quot; \tWscript.Quit end if  WScript.Echo &quot;\u0424\u0430\u0439\u043b \u0441\u043e \u0441\u043f\u0438\u0441\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432: &quot; & gsFileName  Set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;) Set objTextFileOpen = objFSO.OpenTextFile(gsFileName, 1)  gix = 0 giy = 0  Set WshShell = CreateObject(&quot;WScript.Shell&quot;)  do until objTextFileOpen.AtEndOfStream \tgsComputerName = objTextFileOpen.Readline \tgiy = giy + 1 loop   objTextFileOpen.Close  wscript.echo &quot;\u041d\u0430\u0439\u0434\u0435\u043d\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432: &quot; & giy  Set objTextFileOpen = objFSO.OpenTextFile(gsFileName, 1)  do until objTextFileOpen.AtEndOfStream \tgsComputerName = objTextFileOpen.Readline \tgix = gix + 1 \tgiz = gix * 100 \tgiz = giz \/ giy \tgiz = Round(giz, 1) \tgiOst = giy - gix \t \tif fuPing(gsComputerName) then \t\twscript.echo gsComputerName & VBTab & &quot; \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c: &quot; & giOst & &quot;, \u0433\u043e\u0442\u043e\u0432\u043e: &quot; & giz & &quot;%&quot; \t\t \t\tif inStr(gsOS, &quot;XP&quot;) then \t\t\tgsRunCmd = &quot;f:\\Computer\\is_computer_online.bat &quot; & gsComputerName & &quot; y&quot; \t\telseif inStr(gsOS, &quot;7&quot;) then \t\t\tgsRunCmd = &quot;f:\\Computer\\is_computer_online7.bat &quot; & gsComputerName & &quot; y&quot; \t\tend if \t\tWshShell.Run gsRunCmd \t\tif giOst &lt;&gt; 0 then \t\t\tWScript.Sleep 180000 ' \u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435! \u0412\u043e\u0442 \u044d\u0442\u043e \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0430 \u0432 180 \u0441\u0435\u043a\u0443\u043d\u0434 \u043c\u0435\u0436\u0434\u0443 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u043c\u0438. \t\tend if \telse \t\twscript.echo gsComputerName & VBTab & &quot; \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c: &quot; & giOst & &quot;, \u0433\u043e\u0442\u043e\u0432\u043e: &quot; & giz & &quot;%. \u0412\u044b\u043a\u043b\u044e\u0447\u0435\u043d.&quot; \tend if loop   objTextFileOpen.Close  WScript.Echo &quot;\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0430!&quot;  function fuPing(NetworkDevice) \tlBoo = false \tset objPING = GetObject(&quot;winmgmts:{impersonationLevel=impersonate}&quot;)._ \t\tExecQuery (&quot;select * from Win32_PingStatus where address ='&quot; & NetworkDevice & &quot;'&quot;)  \tFor Each PING In objPing \t\tif PING.StatusCode = 0 then \t\t\t'WScript.Echo &quot;* \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 &quot; & NetworkDevice & &quot; \u0432 \u0441\u0435\u0442\u0438!&quot;  \t\t\tlBoo = true \t\telse \t\t\t'WScript.Echo &quot;* \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043d\u0435\u0442 \u0432 \u0441\u0435\u0442\u0438.&quot; \t\tend if \tnext \t \tfuPing = lBoo end function  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  \u0417\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0446\u0435\u0434\u0443\u0440\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 bat-\u0444\u0430\u0439\u043b\u043e\u043c. \u0421\u0441\u044b\u043b\u043a\u0443 \u043d\u0430 \u043d\u0435\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430 \u0440\u0430\u0431\u043e\u0447\u0435\u043c \u0441\u0442\u043e\u043b\u0435.  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">bat-\u0444\u0430\u0439\u043b<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"dos\">cscript \/\/nologo &quot;f:\\Computer\\is_computer_online_listComps.vbs&quot; %1 %2 <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  \u041e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u043a\u0440\u0438\u043f\u0442 is_computer_online_listComps.vbs \u0447\u0438\u0442\u0430\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u0438\u0437 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0438 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 bat-\u0444\u0430\u0439\u043b \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043e\u0442\u0447\u0451\u0442\u0430. \u0414\u043b\u044f XP \u2014 \u044d\u0442\u043e \u0444\u0430\u0439\u043b is_computer_online.bat, \u0434\u043b\u044f 7 \u2014 is_computer_online7.bat.<br \/>  <em>\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435.<\/em><br \/>  \u041d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043d\u0443\u0436\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c <a href=\"http:\/\/www.microsoft.com\/en-us\/download\/details.aspx?id=24659\">logparser<\/a>.<br \/>  \u0412\u0441\u0451 \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u0437\u0430\u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u0422\u043e\u043b\u044c\u043a\u043e \u043d\u0430\u0434\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c Microsoft SQL SERVER 2008 NATIVE CLIENT \u0438 Microsoft SQL Server 2008 Command Line Utilities. \u041d\u043e \u044f \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b. <\/p>\n<h3>\u0411\u043b\u043e\u043a \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u043c\u0438 XP<\/h3>\n<p>  Bat-\u0444\u0430\u0439\u043b:  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">is_computer_online.bat<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"dos\">cscript \/\/nologo &quot;f:\\Computer\\is_computer_online.vbs&quot; %1 %2 <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  Bat-\u0444\u0430\u0439\u043b \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u043a\u0440\u0438\u043f\u0442. \u0421\u043a\u0440\u0438\u043f\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 evt-\u0444\u0430\u0439\u043b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0431\u0430\u0442\u043d\u0438\u043a mo2csv.bat.  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">is_computer_online.vbs<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"vbscript\">on error resume next  dim gsComputerName dim gsUseLogFile dim gsLogFilename dim gbFlag  dim gsTableName dim gsCompName dim gsRunCmd  if Wscript.Arguments.Count = 1 then \tgsComputerName = Wscript.Arguments(0) \tgsUseLogFile = &quot;n&quot; elseif Wscript.Arguments.Count = 2 then \tgsComputerName = Wscript.Arguments(0) \tgsUseLogFile = Wscript.Arguments(1) else \tgsComputerName = InputBox(&quot;\u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;&quot;) \tgsUseLogFile = InputBox(&quot;\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c log-\u0444\u0430\u0439\u043b \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438?&quot; & VBNewline & &quot;[y\/n]&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;y&quot;) end if  WScript.Echo &quot;* \u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 &quot; & gsComputerName gsLogFilename = &quot;f:\\Log\\&quot; & gsComputerName & &quot;.log&quot;  if lCase(gsUseLogFile) = &quot;y&quot; then \tgbFlag = false \tWScript.Echo &quot;* \u0424\u0430\u0439\u043b \u0436\u0443\u0440\u043d\u0430\u043b\u0430 &quot; & gsLogFilename \tset objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)  \tif not objFSO.FileExists(gsLogFilename) then \t\tWScript.Echo &quot;* \u0424\u0430\u0439\u043b\u0430 \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u043d\u0435\u0442. \u0421\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f...&quot; \t\tset objTextFileWriteLog = objFSO.OpenTextFile(gsLogFilename, 8, True) \t\tobjTextFileWriteLog.writeLine &quot;n&quot; \t\tobjTextFileWriteLog.close \t\tWScript.Echo &quot;* \u0421\u043e\u0437\u0434\u0430\u043d \u0443\u0441\u043f\u0435\u0448\u043d\u043e.&quot; \tend if  \tset objTextFileOpen = objFSO.OpenTextFile(gsLogFilename, 1) \tdo until objTextFileOpen.AtEndOfStream \t\trecord = trim(objTextFileOpen.Readline) \t\tif record = &quot;n&quot; then \t\t\tWScript.Echo &quot;* \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b\u0441\u044f \u0440\u0430\u043d\u0435\u0435.&quot; \t\t\tif fuPing(gsComputerName) then \t\t\t\tgbFlag = true \t\t\t\t \t\t\t\tif fuBackup(gsComputerName) then \t\t\t\t\tWScript.Sleep 15000 ' &lt;- 15 \u0441\u0435\u043a\u0443\u043d\u0434 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0438 \u0434\u043b\u044f \u0431\u0435\u043a\u0430\u043f\u0430 \t\t\t\t\tfuUploadEvents gsComputerName \t\t\t\t\twscript.sleep 10000 \t\t\t\tend if \t\t\tend if \t\telseif record = &quot;y&quot; then \t\t\tWScript.Echo &quot;* \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 &quot; & gsComputerName & &quot; \u0443\u0436\u0435 \u0437\u0430\u043a\u0430\u0447\u0430\u043d\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440.&quot; \t\telse  \t\t\tWScript.Echo &quot;* \u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 &quot; & gsComputerName & &quot; \u0432 log-\u0444\u0430\u0439\u043b\u0435.&quot; \t\tend if \tloop  \tobjTextFileOpen.close  \tif gbFlag then \t\tset objTextFileWriteLog = objFSO.OpenTextFile(gsLogFilename, 2, True) \t\tobjTextFileWriteLog.writeLine &quot;y&quot; \t\tobjTextFileWriteLog.close \t\tWScript.Echo &quot;* \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0437\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b.&quot; \tend if else \t'if fuPing(gsComputerName) then \t\tif fuBackup(gsComputerName) then \t\t\tWScript.Sleep 15000 ' &lt;- 15 \u0441\u0435\u043a\u0443\u043d\u0434 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0438 \u0434\u043b\u044f \u0431\u0435\u043a\u0430\u043f\u0430 \t\t\tfuUploadEvents gsComputerName \t\t\twscript.sleep 10000 \t\tend if \t'end if end if  wscript.sleep 1000  function fuPing(NetworkDevice) \tlBoo = false \tset objPING = GetObject(&quot;winmgmts:{impersonationLevel=impersonate}&quot;)._ \t\tExecQuery (&quot;select * from Win32_PingStatus where address ='&quot; & NetworkDevice & &quot;'&quot;)  \tFor Each PING In objPing \t\tif PING.StatusCode = 0 then \t\t\tWScript.Echo &quot;* \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 &quot; & NetworkDevice & &quot; \u0432 \u0441\u0435\u0442\u0438!&quot;  \t\t\tlBoo = true \t\telse \t\t\tWScript.Echo &quot;* \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043d\u0435\u0442 \u0432 \u0441\u0435\u0442\u0438.&quot; \t\tend if \tnext \t \tfuPing = lBoo end function   function fuBackup(lsComputername) \tlsEvtBackupFilename = &quot;c:\\&quot; & lsComputername & &quot;.evt&quot; \tlsEvtBackupFilenameRemote = &quot;\\\\&quot; & lsComputername & &quot;\\c$\\&quot; & lsComputername & &quot;.evt&quot; \tlbFlag = false \t \tset lObjFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;) \t \tif lObjFSO.FileExists(lsEvtBackupFilenameRemote) then \t\tWScript.Echo &quot;* \u0424\u0430\u0439\u043b \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439...&quot; \t\tlbFlag = true \telse \t\tWscript.Echo &quot;* \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0435 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435...&quot; \t\tSet objWMIService = GetObject(&quot;winmgmts:{impersonationLevel=impersonate,(Backup)}!\\\\&quot; & lsComputername & &quot;\\root\\cimv2&quot;) \t\tSet colLogFiles = objWMIService.ExecQuery (&quot;Select * from Win32_NTEventLogFile where LogFileName='Security'&quot;)  \t\tFor Each objLogfile in colLogFiles \t\t\terrBackupLog = objLogFile.BackupEventLog(lsEvtBackupFilename) \t\t\tIf errBackupLog = 0 Then         \t\t\t\tWscript.Echo &quot;* \u0420\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0435 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.&quot; \t\t\t\tlbFlag = true \t\t\tElse \t\t\t\tWscript.Echo &quot;* \u0420\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0435 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043e.&quot; \t\t\tEnd If \t\tNext \tend if \t \tfuBackup = lbFlag end function   function fuUploadEvents(lsComputername) \tWScript.Echo &quot;* \u0417\u0430\u043f\u0443\u0449\u0435\u043d\u0430 \u0437\u0430\u043a\u0430\u0447\u043a\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440...&quot; \tgsCompName = lCase(lsComputername)  \tgsTableName = fuGetTableName(gsCompName) \tgsTableName = uCase(gsTableName) \tgsOutputFilename = &quot;f:\\Computer\\&quot; & gsCompName & &quot;.csv&quot; \tgsOutputFilenameSQL = &quot;f:\\Computer\\&quot; & gsCompName & &quot;_sql.csv&quot;  \tSet WshShell = CreateObject(&quot;WScript.Shell&quot;) \tgsRunCmd = &quot;f:\\Computer\\mo2csv.bat &quot; & gsCompName & &quot; &quot; & gsOutputFilename & &quot; &quot; & gsOutputFilenameSQL & &quot; &quot; & gsTableName  \tWScript.Echo &quot;* \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u0430: '&quot; & gsRunCmd & &quot;'&quot; \tWshShell.Run gsRunCmd end function   function fuGetTableName(lsCompName) \tlsTmp = lsCompName \t \tif InStr(lsTmp, &quot;-&quot;) then \t\tlsTmp = Replace(lsTmp, &quot;-&quot;, &quot;_&quot;) \tend if \t \tfuGetTableName = lsTmp end function  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  mo2csv.bat \u0434\u0435\u043b\u0430\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:  <\/p>\n<ul>\n<li>\u0417\u0430\u0431\u0438\u0440\u0430\u0435\u0442 evt-\u0444\u0430\u0439\u043b \u0441 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440.<\/li>\n<li>\u041f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u044b\u0432\u0430\u0435\u0442 evt-\u0444\u0430\u0439\u043b \u0432 evtx.<\/li>\n<li>\u0412\u044b\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u0431\u044b\u0442\u0438\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430\/\u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0438\u0437 evtx-\u0444\u0430\u0439\u043b\u0430 \u0432 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0439 \u0444\u0430\u0439\u043b csv.<\/li>\n<li>\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0437\u0430\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u043d\u0430 SQL Server.<\/li>\n<li>\u0411\u0435\u043a\u0430\u043f\u0438\u0442 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 evt-\u0444\u0430\u0439\u043b \u0432 \u043f\u0430\u043f\u043a\u0443 Logi_ForReports (\u0432\u0434\u0440\u0443\u0433 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u043e\u0442\u0440\u0451\u0442 \u0441\u0432\u043e\u0439 \u0436\u0443\u0440\u043d\u0430\u043b, \u0430 \u0443 \u043d\u0430\u0441 \u043a\u043e\u043f\u0438\u044f \u0435\u0441\u0442\u044c).<\/li>\n<li>\u0423\u0434\u0430\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 evtx-\u0444\u0430\u0439\u043b.<\/li>\n<li>\u0424\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 sql-\u0437\u0430\u043f\u0440\u043e\u0441 \u043a SQL Server\u2019\u0443.<\/li>\n<li>\u0423\u0434\u0430\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b (\u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u043b\u0430\u0434\u043a\u0438 \u0438\u043b\u0438 \u0434\u043b\u044f \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043a\u0440\u0438\u043f\u0442\u0430, \u044d\u0442\u043e\u0442 \u0440\u0430\u0437\u0434\u0435\u043b \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c).<\/li>\n<li>\u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0435\u0442 \u043e\u0442\u0447\u0451\u0442\u044b \u0432 \u043f\u0430\u043f\u043a\u0443 CheckComps.<\/li>\n<\/ul>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">mo2csv.bat<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"dos\">@echo off  @set WDate=%date:~-10%  @echo * \u0416\u0443\u0440\u043d\u0430\u043b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 %1 (Windows XP)... move \\\\%1\\c$\\%1.evt f:\\Logs\\ @echo * \u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0430\u0446\u0438\u044f evt \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0432 evtx... wevtutil epl f:\\Logs\\%1.evt f:\\Logs\\%1.evtx \/lf:true @echo * \u041a\u043e\u043d\u0432\u0435\u0440\u0442\u0430\u0446\u0438\u044f \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0430.  @echo * \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0438\u0437 \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u044b\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0439 \u0444\u0430\u0439\u043b. \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: f:\\Logs\\%1.evtx, \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435: %2 LogParser.exe file:&quot;f:\\Computer\\get_info_from_log.sql&quot;?source=f:\\Logs\\%1.evtx+output_file=%2 -i:EVT -o:TSV -headers:ON -oSeparator:tab -oTsFormat:&quot;dd.MM.yyyy hh:mm:ss&quot; -fileMode:1 @echo * \u0412\u044b\u0433\u0440\u0443\u0437\u043a\u0430 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0430.  @echo * \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0439 \u0444\u0430\u0439\u043b %2. \u041f\u043e\u043b\u0443\u0447\u0430\u044e %3... cscript F:\\Computer\\update_csvFile_forSQLCheck.vbs %2 %3 \/\/NoLogo @echo * \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.   @echo * \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0438\u0437 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0437\u0430\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 SQL Server. \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: %3, \u0442\u0430\u0431\u043b\u0438\u0446\u0430 %4... LogParser.exe file:&quot;f:\\Computer\\get_info_from_log_2SQL.sql&quot;?source=%3+output_file=%4 -i:TSV -headerRow:ON -iSeparator:tab -iTsFormat:&quot;dd.MM.yyyy hh:mm:ss&quot; -o:SQL -server:&quot;SQL-SRV\\SEC&quot; -database:quickly -driver:&quot;SQL Server&quot; -createTable:ON @echo * \u041f\u0440\u043e\u0446\u0435\u0441\u0441 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d.   @echo * \u0416\u0443\u0440\u043d\u0430\u043b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0432... move f:\\Logs\\%1.evt f:\\Logi_ForReports\\%1_%WDate%_sec.evt @echo * \u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e. \u0418\u043c\u044f \u0430\u0440\u0445\u0438\u0432\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 'f:\\Logi_ForReports\\%1_%WDate%_sec.evt'  @echo * \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0433\u043e evtx \u0436\u0443\u0440\u043d\u0430\u043b\u0430... del f:\\Logs\\%1.evtx @echo * \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.   @echo * \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 sql-\u0437\u0430\u043f\u0440\u043e\u0441\u0430... cscript &quot;F:\\Computer\\create_SQL_full.vbs&quot; %1 1 \/\/nologo @echo * \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 sql-\u0437\u0430\u043f\u0440\u043e\u0441\u0430... SQLCMD.EXE -S SQL-SRV\\SEC -d quickly -E -i f:\\Computer\\%1-1.sql -o &quot;f:\\Computer\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.csv&quot; -W -R -s &quot;;&quot; -w 4000 @echo * \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0444\u0430\u0439\u043b\u044b \u043e\u0442\u0447\u0435\u0442\u043e\u0432... cscript F:\\Computer\\update_result_file.vbs &quot;f:\\Computer\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.csv&quot; \/\/nologo @echo * \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432... del f:\\Computer\\%1-1.sql del %2 del %3 del f:\\Computer\\%1_dbg.txt del &quot;f:\\Computer\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.csv&quot; @echo * \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432-\u043e\u0442\u0447\u0435\u0442\u043e\u0432... move &quot;f:\\Computer\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.xls&quot; &quot;f:\\CheckComps\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.xls&quot; @echo * \u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo on <\/code><\/pre>\n<p><em>\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435<\/em><br \/>  \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0432 \u0431\u0430\u0442\u043d\u0438\u043a\u0435 \u043d\u0443\u0436\u043d\u043e \u0431\u0443\u0434\u0435\u0442 SQLCMD.EXE \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u00abc:\\Program Files\\Microsoft SQL Server\\100\\Tools\\Binn\\SQLCMD.EXE\u00bb, \u0430 LogParser.exe \u043d\u0430 \u00abc:\\Program Files (x86)\\Log Parser 2.2\\LogParser.exe\u00bb (\u0438\u043b\u0438 \u00abc:\\Program Files\\Log Parser 2.2\\LogParser.exe\u00bb).<br \/>  \u0418\u043c\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441 SQL Server\u2019\u043e\u043c SQL-SRV, \u0438\u043c\u044f \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430 SEC \u0438 \u0438\u043c\u044f \u0431\u0430\u0437\u044b quickly. \u0417\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u0441\u0432\u043e\u0438.   <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">get_info_from_log.sql<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"sql\">SELECT RecordNumber as id,  \teventid as eId,  \tTimeGenerated as Tg,  \tresolve_sid(sid) as UserName,  \tcomputername as Computer,  \tEXTRACT_TOKEN(Strings, 0, '|') as image_unique_id, \tEXTRACT_TOKEN(Strings, 1, '|') as image into %output_file%  FROM %source% where ((EventID in (592; 593)) and (TO_UPPERCASE(resolve_sid(sid)) &lt;&gt; 'NT AUTHORITY\\NETWORK SERVICE') and (TO_UPPERCASE(resolve_sid(sid)) &lt;&gt; 'NT AUTHORITY\\SYSTEM')) and TimeGenerated &gt;= TO_TIMESTAMP('01.03.2011 00:00:00','dd.MM.yyyy hh:mm:ss') order by recordnumber asc <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">get_info_from_log_2SQL.sql<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"sql\">SELECT * into %output_file%  FROM %source% <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">update_csvFile_forSQLCheck.vbs<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"vbscript\">On Error Resume Next  dim gsSimbolSplitFields dim sgSimbolSplitAdmin dim gbInsideBlock dim gIx dim gbDebug dim gbWriteString  Dim gArrBlock_admin  gsSimbolSplitFields = vbTab sgSimbolSplitAdmin = &quot;;&quot; gbInsideBlock = false gbIERuning = false gbIE = false giBlockPlus = 0 giIEPlus = 0 gsDateBlock = &quot;01.01.2011 00:00:00&quot; TgBlockStop = &quot;01.01.2011 00:00:00&quot; idBlockStop = &quot;&quot; gIx = 0 gArrBlock_admin = Array (sgSimbolSplitAdmin & sgSimbolSplitAdmin, _ \tsgSimbolSplitAdmin & sgSimbolSplitAdmin, _ \tsgSimbolSplitAdmin & sgSimbolSplitAdmin, _ \tsgSimbolSplitAdmin & sgSimbolSplitAdmin) gbDebug = true 'gbDebug = false  if Wscript.Arguments.Count = 1 then \tsgFilename = Wscript.Arguments(0) \tsgFilenameOut = fuRemoveExtention(sgFilename) & &quot;_sql.csv&quot; \tgsLogFilename = fuRemoveExtention(sgFilename) & &quot;_dbg.txt&quot; elseif Wscript.Arguments.Count = 2 then \tsgFilename = Wscript.Arguments(0) \tsgFilenameOut = Wscript.Arguments(1) \tgsLogFilename = fuRemoveExtention(sgFilename) & &quot;_dbg.txt&quot; elseif Wscript.Arguments.Count = 3 then \tsgFilename = Wscript.Arguments(0) \tsgFilenameOut = Wscript.Arguments(1) \tgsLogFilename = Wscript.Arguments(2) else \tsgFilename = InputBox(&quot;\u0418\u043c\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;f:\\comp-6475.csv&quot;) \tsgFilenameOut = InputBox(&quot;\u0418\u043c\u044f \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0444\u0430\u0439\u043b\u0430&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, fuRemoveExtention(sgFilename) & &quot;_sql.csv&quot;) \tgsLogFilename = InputBox(&quot;\u0418\u043c\u044f \u0444\u0430\u0439\u043b\u0430 \u0436\u0443\u0440\u043d\u0430\u043b\u0430&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, fuRemoveExtention(sgFilename) & &quot;_dbg.txt&quot;) end if  Set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)  if not objFSO.FileExists(sgFilename) then \twscript.echo &quot;\u0418\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0434\u043b\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u0442, \u0432\u044b\u0445\u043e\u0436\u0443!&quot; \tWscript.Quit end if  Set objTextFileOpen = objFSO.OpenTextFile(sgFilename, 1) Set objTextFileWrite = objFSO.CreateTextFile(sgFilenameOut, True)  if gbDebug then \tif not objFSO.FileExists(gsLogFilename) then \t\tset objTextFileWriteLog = objFSO.OpenTextFile(gsLogFilename, 8, True) \telse \t\tset objTextFileWriteLog = objFSO.CreateTextFile(gsLogFilename, True) \tend if end if \t Do Until objTextFileOpen.AtEndOfStream \trecord = trim(objTextFileOpen.Readline) \tgIx = gIx + 1 \tgbWriteString = true \tfuPrint gIx & &quot;. '&quot; & record & &quot;'&quot; \t \tif InStr(record, gsSimbolSplitFields) then \t\tarr = Split(record, gsSimbolSplitFields) \t\tid = arr(0) \t\teId = arr(1) \t\tTg = arr(2) \t\tUserName = arr(3) \t\tComputer = arr(4) \t\timage_unique_id = arr(5) \t\timage = arr(6) \t\t \t\tif InStr(lCase(image), &quot;explorer.exe&quot;) then \t\t\tif eId = &quot;592&quot; then \t\t\t\tgbBlockBegin = true \t\t\t\tgbBlockEnd = false \t\t\t\tgiBlockPlus = giBlockPlus + 1 \t\t\t\tfuPrint &quot;explorer.exe \u0441\u0442\u0430\u0440\u0442&quot; \t\t\telse  \t\t\t\tgbBlockBegin = false \t\t\t\tgbBlockEnd = true \t\t\t\tgiBlockPlus = giBlockPlus - 1 \t\t\t\tif giBlockPlus &lt; 0 then \t\t\t\t\tgiBlockPlus = 0 \t\t\t\tend if \t\t\t\tfuPrint\t&quot;explorer.exe \u0441\u0442\u043e\u043f&quot; \t\t\tend if \t\telse \t\t\tgbBlockBegin = false \t\t\tgbBlockEnd = false \t\tend if \t\t \t\tif InStr(lCase(image), &quot;iexplore.exe&quot;) then \t\t\tgbIE = true \t\t\tfuPrint\t&quot;\u0421\u0442\u0440\u043e\u043a\u0430 \u0441 iexplore.exe&quot; \t\t\t \t\t\tif eId = &quot;592&quot; then \t\t\t\tfuPrint\t&quot;iexplore.exe \u0441\u0442\u0430\u0440\u0442&quot; \t\t\t\tgiIEPlus = giIEPlus + 1 \t\t\t\tgbIERuning = true \t\t\t\t \t\t\t\tif giIEPlus = 1 then \t\t\t\t\timage_unique_idIEStart = image_unique_id \t\t\t\tend if \t\t\telse  \t\t\t\tfuPrint\t&quot;iexplore.exe \u0441\u0442\u043e\u043f&quot; \t\t\t\tgiIEPlus = giIEPlus - 1 \t\t\t\tgbIERuning = false \t\t\tend if \t\telse  \t\t\tgbIE = false \t\t\tfuPrint\t&quot;\u0421\u0442\u0440\u043e\u043a\u0430 \u0431\u0435\u0437 iexplore.exe&quot; \t\tend if \t\t \t\tif gIx = 1 then \t\t\tobjTextFileWrite.WriteLine record & gsSimbolSplitFields & &quot;CompStart&quot; \t\t\tfuPrint &quot;\u041f\u0435\u0440\u0432\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430, \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c&quot; \t\telseif gIx = 2 then \t\t\tfuPrint &quot;\u0432\u0442\u043e\u0440\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430&quot; \t\t\tif gbBlockBegin then \t\t\t\tfuPrint &quot;\u041d\u0430\u0447\u0430\u043b\u043e \u0431\u043b\u043e\u043a\u0430, \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c&quot; \t\t\t\tgbInsideBlock = true \t\t\t\tgsDateBlock = Tg \t\t\t\tgsUserNameBlockStart = UserName \t\t\t\timage_unique_idBlockStart = image_unique_id \t\t\t\tobjTextFileWrite.WriteLine record & gsSimbolSplitFields & gsDateBlock \t\t\tend if \t\t\t \t\t\tidPrev = id \t\t\teIdPrev = eId \t\t\tTgPrev = Tg \t\t\tUserNamePrev = UserName \t\t\tComputerPrev = Computer \t\t\timage_unique_idPrev = image_unique_id \t\t\timagePrev = image\t \t\telse \t\t\t'fuPrint &quot;\u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u0442\u0440\u043e\u043a\u0438&quot; \t\t\t \t\t\t'-- \u0417\u0430\u043f\u0443\u0441\u043a explorer.exe \t\t\tif gbBlockBegin then \t\t\t\tfuPrint &quot;\u0417\u0430\u043f\u0443\u0441\u043a explorer.exe (\u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u2116 &quot; & giBlockPlus & &quot;)&quot; \t\t\t\t \t\t\t\tif giBlockPlus = 1 then \t\t\t\t\tgiDiff = DateDiff(&quot;s&quot;, CDate(TgBlockStop), CDate(Tg)) \t\t\t\t\tif giDiff &gt; 9 then \t\t\t\t\t\tif Len(idBlockStop) &gt; 0 then \t\t\t\t\t\t\tfuPrint &quot;\u042d\u0442\u043e \u043d\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a explorer.exe. \u0417\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u0431\u043b\u043e\u043a\u0430&quot; \t\t\t\t\t\t\trecord_convert_prev = idBlockStop & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t\teIdBlockStop & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t\tTgBlockStop & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t\tUserNameBlockStop & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t\tComputerBlockStop & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t\timage_unique_idBlockStart & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t\timageBlockStop & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t\tgsDateBlock \t\t\t\t\t\t\tfuPrint record_convert_prev \t\t\t\t\t\t\tobjTextFileWrite.WriteLine record_convert_prev \t\t\t\t\t\tend if \t\t\t\t\t\t \t\t\t\t\t\tgsDateBlock = Tg \t\t\t\t\t\tfuPrint &quot;\u041d\u043e\u0432\u0430\u044f \u0434\u0430\u0442\u0430 \u0431\u043b\u043e\u043a\u0430: '&quot; & gsDateBlock & &quot;'&quot; \t\t\t\t\t\timage_unique_idBlockStart = image_unique_id \t\t\t\t\t\tfuPrint &quot;\u041d\u043e\u0432\u044b\u0439 \u043a\u043e\u0434 \u0431\u043b\u043e\u043a\u0430: '&quot; & image_unique_idBlockStart & &quot;'&quot; \t\t\t\t\t\tgsUserNameBlockStart = UserName \t\t\t\t\t\tfuPrint &quot;\u041d\u043e\u0432\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u043b\u043e\u043a\u0430: '&quot; & gsUserNameBlockStart & &quot;'&quot; \t\t\t\t\telse \t\t\t\t\t\tfuPrint &quot;\u042d\u0442\u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a explorer.exe! \u041d\u0435 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u043e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u0431\u043b\u043e\u043a\u0430 \u0438 \u043d\u0435 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u0437\u0430\u043f\u0443\u0441\u043a \u044d\u0442\u043e\u0433\u043e.&quot; \t\t\t\t\t\tgbWriteString = false \t\t\t\t\tend if \t\t\t\t\t \t\t\t\t\tgbInsideBlock = true \t\t\t\telse \t\t\t\t\tif lCase(gsUserNameBlockStart) = lCase(UserName) then \t\t\t\t\t\tfuPrint &quot;gsUserNameBlockStart: '&quot; & gsUserNameBlockStart & &quot;', UserName: '&quot; & UserName & &quot;'&quot; \t\t\t\t\t\tfuPrint &quot;\u041d\u0430\u0447\u0430\u043b\u043e \u0431\u043b\u043e\u043a\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u0431\u044b\u043b \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e \u0432\u044b\u043a\u043b\u044e\u0447\u0435\u043d. \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u043e\u043a\u043e\u043d\u0447\u0430\u043d\u0438\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0433\u043e \u0431\u043b\u043e\u043a\u0430 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043d\u043e\u0432\u044b\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0431\u043b\u043e\u043a\u0430&quot; \t\t\t\t\t\trecord_convert_prev = &quot;999&quot; & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t&quot;593&quot; & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\tTg & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\tUserName & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\tComputer & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\timage_unique_idBlockStart & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\t&quot;C:\\WINDOWS\\explorer.exe&quot; & gsSimbolSplitFields & _ \t\t\t\t\t\t\t\tgsDateBlock \t\t\t\t\t\tfuPrint record_convert_prev \t\t\t\t\t\tobjTextFileWrite.WriteLine record_convert_prev \t\t\t\t\t\t \t\t\t\t\t\tgiBlockPlus = 1 \t\t\t\t\t\t \t\t\t\t\t\tgsDateBlock = Tg \t\t\t\t\t\tfuPrint &quot;\u041d\u043e\u0432\u0430\u044f \u0434\u0430\u0442\u0430 \u0431\u043b\u043e\u043a\u0430: '&quot; & gsDateBlock & &quot;'&quot; \t\t\t\t\t\timage_unique_idBlockStart = image_unique_id \t\t\t\t\t\tfuPrint &quot;\u041d\u043e\u0432\u044b\u0439 \u043a\u043e\u0434 \u0431\u043b\u043e\u043a\u0430: '&quot; & image_unique_idBlockStart & &quot;'&quot; \t\t\t\t\telse \t\t\t\t\t\t'fuPrint &quot;gsUserNameBlockStart: '&quot; & gsUserNameBlockStart & &quot;', UserName: '&quot; & UserName & &quot;'&quot; \t\t\t\t\t\tfuPrint &quot;\u041d\u0435 \u043d\u0430\u0447\u0430\u043b\u043e \u0431\u043b\u043e\u043a\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b explorer. \u0417\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b&quot; \t\t\t\t\t\tgArrBlock_admin(giBlockPlus-2) = image_unique_id & sgSimbolSplitAdmin & UserName & sgSimbolSplitAdmin & Tg \t\t\t\t\t\tfuPrint gArrBlock_admin(giBlockPlus-2) \t\t\t\t\t\t'gsDateBlock_admin = Tg \t\t\t\t\t\tobjTextFileWrite.WriteLine record & gsSimbolSplitFields & Tg \t\t\t\t\t\tgbWriteString = false \t\t\t\t\tend if \t\t\t\tend if \t\t\tend if \t\t\t \t\t\t'-- \u041e\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 explorer.exe \t\t\tif gbBlockEnd then \t\t\t\tfuPrint &quot;\u041e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d explorer.exe (\u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 &quot; & giBlockPlus & &quot;)&quot; \t\t\t\t \t\t\t\tif giBlockPlus = 0 then \t\t\t\t\tfuPrint &quot;\u041e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440, \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u043c \u0435\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f&quot; \t\t\t\t\t \t\t\t\t\tidBlockStop = id \t\t\t\t\teIdBlockStop = eId \t\t\t\t\tTgBlockStop = Tg \t\t\t\t\tUserNameBlockStop = UserName \t\t\t\t\tComputerBlockStop = Computer \t\t\t\t\timage_unique_idBlockStop = image_unique_id \t\t\t\t\timageBlockStop = image \t\t\t\t\t \t\t\t\t\tgbInsideBlock = false \t\t\t\t\tgiIEPlus = 0 ' &lt;-- \u0414\u043e\u0431\u0430\u0432\u0438\u043b \u0434\u043b\u044f \u043e\u0431\u043d\u0443\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043a\u043e\u043f\u0438\u0439 IE \t\t\t\telse \t\t\t\t\tfuPrint &quot;\u041e\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d \u043d\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440, \u0435\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043d\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u043c, \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c \u0442\u0435\u043a\u0443\u0449\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443&quot;\t\t \t\t\t\t\tfor giY = 0 to UBound(gArrBlock_admin) \t\t\t\t\t\tarrA = Split(gArrBlock_admin(giY), sgSimbolSplitAdmin) \t\t\t\t\t\tgsImage_unique_id_A = arrA(0) \t\t\t\t\t\tgsUserName_A = arrA(1) \t\t\t\t\t\tgsTg_A = arrA(2) \t\t\t\t\t\t \t\t\t\t\t\tif gsImage_unique_id_A = image_unique_id then \t\t\t\t\t\t\tgsDateBlock_admin = gsTg_A \t\t\t\t\t\tend if \t\t\t\t\tnext \t\t\t\t\tobjTextFileWrite.WriteLine record & gsSimbolSplitFields & gsDateBlock_admin \t\t\t\t\tgbWriteString = false \t\t\t\tend if \t\t\tend if \t\t\t \t\t\t'-- \u0417\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0443\u044e \u0441\u0442\u0440\u043e\u043a\u0443  \t\t\tif gbInsideBlock then \t\t\t\tif gbIE then \t\t\t\t\tif (((gbIERuning) and (giIEPlus = 1)) or ((not gbIERuning) and (giIEPlus = 0))) then \t\t\t\t\t\tfuPrint &quot;\u0417\u0430\u043f\u0438\u0441\u0430\u0442\u044c IE \u0441\u0442\u0440\u043e\u043a\u0443&quot; \t\t\t\t\t\trecord_convert_prev = id & gsSimbolSplitFields & _ \t\t\t\t\t\t\teId & gsSimbolSplitFields & _ \t\t\t\t\t\t\tTg & gsSimbolSplitFields & _ \t\t\t\t\t\t\tUserName & gsSimbolSplitFields & _ \t\t\t\t\t\t\tComputer & gsSimbolSplitFields & _ \t\t\t\t\t\t\timage_unique_idIEStart & gsSimbolSplitFields & _ \t\t\t\t\t\t\timage & gsSimbolSplitFields & _ \t\t\t\t\t\t\tgsDateBlock \t\t\t\t\t\tfuPrint record_convert_prev \t\t\t\t\t\tobjTextFileWrite.WriteLine record_convert_prev \t\t\t\t\telse \t\t\t\t\t\tfuPrint &quot;\u0412\u043e\u0442 \u0445\u0440\u0435\u043d\u044c \u0441 IE! gbIERuning: &quot; & gbIERuning & &quot;, giIEPlus: &quot; & giIEPlus \t\t\t\t\t\trecord_convert_prev = id & gsSimbolSplitFields & _ \t\t\t\t\t\t\teId & gsSimbolSplitFields & _ \t\t\t\t\t\t\tTg & gsSimbolSplitFields & _ \t\t\t\t\t\t\tUserName & gsSimbolSplitFields & _ \t\t\t\t\t\t\tComputer & gsSimbolSplitFields & _ \t\t\t\t\t\t\timage_unique_idIEStart & gsSimbolSplitFields & _ \t\t\t\t\t\t\timage & gsSimbolSplitFields & _ \t\t\t\t\t\t\tgsDateBlock \t\t\t\t\t\tfuPrint record_convert_prev \t\t\t\t\tend if \t\t\t\telse \t\t\t\t\tif gbWriteString then \t\t\t\t\t\tfuPrint &quot;\u0422\u0435\u043a\u0443\u0449\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430 \u0432 \u0431\u043b\u043e\u043a\u0435 \u0438 \u0435\u0435 \u043d\u0443\u0436\u043d\u043e \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c&quot; \t\t\t\t\t\tfuPrint record & gsSimbolSplitFields & gsDateBlock \t\t\t\t\t\tobjTextFileWrite.WriteLine record & gsSimbolSplitFields & gsDateBlock \t\t\t\t\telse \t\t\t\t\t\tfuPrint &quot;\u0422\u0435\u043a\u0443\u0449\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430 \u0432 \u0431\u043b\u043e\u043a\u0435, \u043d\u043e \u0435\u0435 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u043d\u0435 \u043d\u0443\u0436\u043d\u043e&quot; \t\t\t\t\tend if \t\t\t\tend if \t\t\telse \t\t\t\tfuPrint &quot;\u0422\u0435\u043a\u0443\u0449\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430 \u043d\u0435 \u0432 \u0431\u043b\u043e\u043a\u0435. \u041d\u0435 \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c&quot; \t\t\tend if  \t\t\t'-- \u0421\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0438\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0434\u043b\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0440\u043e\u0445\u043e\u0434\u0430  \t\t\tidPrev = id \t\t\teIdPrev = eId \t\t\tTgPrev = Tg \t\t\tUserNamePrev = UserName \t\t\tComputerPrev = Computer \t\t\timage_unique_idPrev = image_unique_id \t\t\timagePrev = image \t\tend if \tend if \tfuPrint &quot;----------------------------------------------&quot; Loop  objTextFileWrite.Close objTextFileOpen.Close  if gbDebug then \tobjTextFileWriteLog.close end if  WScript.Echo &quot;&quot; WScript.Echo &quot;* \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0430.&quot;    function fuRemoveExtention(lsFilename) \tlRes = lsFilename \tif InStr(lsFilename, &quot;.&quot;) then \t\tlRes = Left(lsFilename, Len(lsFilename)-4) \tend if \tfuRemoveExtention = lRes end function   function fuGetDateFromFullDate(lsFullDate) \tlRes = lsFullDate \tif InStr(lsFullDate, &quot; &quot;) then \t\tlArr = Split(lsFullDate, &quot; &quot;) \t\tlsDate = lArr(0) \t\tlsTime = lArr(1) \t\tlRes = lsDate \tend if \tfuGetDateFromFullDate = lRes end function   function fuGetTimeFromFullDate(lsFullDate) \tlRes = lsFullDate \tif InStr(lsFullDate, &quot; &quot;) then \t\tlArr = Split(lsFullDate, &quot; &quot;) \t\tlsDate = lArr(0) \t\tlsTime = lArr(1) \t\tlRes = lsTime \tend if \tfuGetDateFromFullDate = lRes end function   function fuPrint(lsStr) \t'if gbDebug then \t'\twscript.echo lsStr \t'end if \t \tif gbDebug then \t\tobjTextFileWriteLog.writeLine lsStr \tend if \t \tfuPrint = true end function  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">create_SQL_full.vbs<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"vbscript\">if Wscript.Arguments.Count = 1 then \tgsComputerName = Wscript.Arguments(0) \tgsSQLtype = &quot;1&quot; elseif Wscript.Arguments.Count = 2 then \tgsComputerName = Wscript.Arguments(0) \tgsSQLtype = Wscript.Arguments(1) else \tgsComputerName = InputBox(&quot;\u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;&quot;) \tgsSQLtype = InputBox(&quot;\u0422\u0438\u043f sql-\u0437\u0430\u043f\u0440\u043e\u0441\u0430?&quot; & VBNewline & &quot;[1 - \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439, 2 - \u043f\u043e\u043b\u043d\u044b\u0439, 3 - \u043e\u0431\u0430]&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;1&quot;) end if  set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)  if gsSQLtype = &quot;1&quot; then \tfuCreateSQLFile gsComputerName, &quot;1&quot; elseif gsSQLtype = &quot;2&quot; then \tfuCreateSQLFile gsComputerName, &quot;2&quot; elseif gsSQLtype = &quot;3&quot; then \tfuCreateSQLFile gsComputerName, &quot;1&quot; \tfuCreateSQLFile gsComputerName, &quot;2&quot; end if  function fuGetTableName(lsCompName) \tlsTmp = lsCompName \t \tif InStr(lsTmp, &quot;-&quot;) then \t\tlsTmp = Replace(lsTmp, &quot;-&quot;, &quot;_&quot;) \tend if \t \tfuGetTableName = lsTmp end function   sub fuCreateSQLFile(lsComputerName, lsSQLtype) \tif lsSQLtype = &quot;1&quot; then \t\tlsTemplateFilename = &quot;f:\\Computer\\template-short.sql&quot; \telseif gsSQLtype = &quot;2&quot; then \t\tlsTemplateFilename = &quot;f:\\Computer\\template-full.sql&quot; \tend if \t \tlsLogFilename = &quot;f:\\Computer\\&quot; & lsComputerName & &quot;-&quot; & lsSQLtype & &quot;.sql&quot; \tlsTableName = fuGetTableName(lsComputerName)  \tif not objFSO.FileExists(lsLogFilename) then \t\tset objTextFileWriteLog = objFSO.OpenTextFile(lsLogFilename, 8, True) \telse \t\tset objTextFileWriteLog = objFSO.OpenTextFile(lsLogFilename, 2, True) \tend if \t \tSet objTextFileOpen = objFSO.OpenTextFile(lsTemplateFilename, 1) \t \tdo until objTextFileOpen.AtEndOfStream \t\trecord = objTextFileOpen.Readline \t\tif InStr(record, &quot;WARNING__TABLE_NAME_FOR_CHANGE&quot;) then \t\t\trecord = Replace(record, &quot;WARNING__TABLE_NAME_FOR_CHANGE&quot;, lsTablename) \t\tend if \t\tobjTextFileWriteLog.writeLine record \tloop   \tobjTextFileOpen.Close \tobjTextFileWriteLog.Close end sub  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">template-short.sql<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"sql\">SELECT     TOP (100) PERCENT Computer AS [\u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430], UserName AS [\u0423\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c], image AS \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430, start_time AS [\u0412\u0440\u0435\u043c\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430],                        stop_time AS [\u0412\u0440\u0435\u043c\u044f \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f], dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) \/ 3600))                        + ':' + dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) % 3600 \/ 60))                        + ':' + dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) % 3600 % 60)) AS \u0414\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c FROM         (SELECT     r.Computer, r.UserName, r.image_unique_id, r.image, r.Tg AS start_time, MIN(s.Tg) AS stop_time                        FROM          (SELECT     id, eId, Tg, UserName, Computer, image_unique_id, image                                                FROM          dbo.WARNING__TABLE_NAME_FOR_CHANGE                                                WHERE      (eId = 592) AND (Tg &gt; CONVERT(DATETIME, '2013-01-01 00:00:00.000', 102))                                                ) AS r INNER JOIN                                                   (SELECT     id, eId, Tg, UserName, Computer, image_unique_id, image                                                     FROM          dbo.WARNING__TABLE_NAME_FOR_CHANGE                                                     WHERE      (eId = 593)) AS s ON r.image_unique_id = s.image_unique_id AND r.image = s.image AND r.id &lt; s.id AND r.Tg &lt;= s.Tg                        GROUP BY r.UserName, r.Computer, r.image_unique_id, r.image, r.Tg) AS DERIVEDTBL ORDER BY '\u0412\u0440\u0435\u043c\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430' DESC <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">update_result_file.vbs<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"vbscript\">if Wscript.Arguments.Count = 1 then \tgsFileName = Wscript.Arguments(0) \tgsFileNameRes = fuRemoveExtention(gsFileName) & &quot;.xls&quot; elseif Wscript.Arguments.Count = 2 then \tgsFileName = Wscript.Arguments(0) \tgsFileNameRes = Wscript.Arguments(1) else \tgsFileName = InputBox(&quot;\u0424\u0430\u0439\u043b \u0434\u043b\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f&quot;, &quot;\u0412\u0432\u043e\u0434&quot;, &quot;&quot;) \tgsFileNameRes = InputBox(&quot;\u0424\u0430\u0439\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0430&quot;, &quot;\u0412\u0432\u043e\u0434&quot;, fuRemoveExtention(gsFileName) & &quot;.xls&quot;) end if  sgSimbolSplit = &quot;;&quot; gsSimbolSplitFields = vbTab  Set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;) Set objTextFileOpen = objFSO.OpenTextFile(gsFileName, 1)  if not objFSO.FileExists(gsFileName) then \twscript.echo &quot;\u0418\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0434\u043b\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u0442, \u0432\u044b\u0445\u043e\u0436\u0443!&quot; \tobjTextFileOpen.Close \tWscript.Quit end if  if not objFSO.FileExists(gsFileNameRes) then \tset objTextFileWriteRes = objFSO.OpenTextFile(gsFileNameRes, 8, True) else \tset objTextFileWriteRes = objFSO.CreateTextFile(gsFileNameRes, True) end if  do until objTextFileOpen.AtEndOfStream \trecord = objTextFileOpen.Readline \t \tif ((InStr(record, &quot;--------&quot;)) or (Len(record) = 0) or (InStr(record, &quot;\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043e \u0441\u0442\u0440\u043e\u043a&quot;)) or (InStr(record, &quot;rows affected&quot;))) then \t\t'wscript.echo &quot;\u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044e \u0441\u0442\u0440\u043e\u043a\u0443: '&quot; & record & &quot;'&quot; \telse \t\tif InStr(record, sgSimbolSplit) then \t\t\trecordRes = Replace(record, sgSimbolSplit, gsSimbolSplitFields) \t\telse \t\t\trecordRes = record \t\tend if \t\t \t\tobjTextFileWriteRes.writeLine recordRes \tend if loop   objTextFileWriteRes.Close objTextFileOpen.Close  WScript.Echo &quot;\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e! \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0444\u0430\u0439\u043b &quot; & gsFileNameRes  function fuRemoveExtention(lsFilename) \tlRes = lsFilename \tif InStr(lsFilename, &quot;.&quot;) then \t\tlRes = Left(lsFilename, Len(lsFilename)-4) \tend if \tfuRemoveExtention = lRes end function  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<h3>\u0411\u043b\u043e\u043a \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u043c\u0438 \u0441 \u0441\u0435\u043c\u0451\u0440\u043a\u043e\u0439<\/h3>\n<p>  Bat-\u0444\u0430\u0439\u043b:  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">is_computer_online7.bat<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"dos\">cscript \/\/nologo &quot;f:\\Computer\\is_computer_online7.vbs&quot; %1 %2 <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  Bat-\u0444\u0430\u0439\u043b \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0441\u043a\u0440\u0438\u043f\u0442. \u0421\u043a\u0440\u0438\u043f\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 evt-\u0444\u0430\u0439\u043b \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0431\u0430\u0442\u043d\u0438\u043a mo7.bat.  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">is_computer_online7.vbs<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"vbscript\">on error resume next  dim gsComputerName dim gsUseLogFile dim gsLogFilename dim gbFlag  dim gsTableName dim gsCompName dim gsRunCmd   if Wscript.Arguments.Count = 1 then \tgsComputerName = Wscript.Arguments(0) \tgsUseLogFile = &quot;n&quot; elseif Wscript.Arguments.Count = 2 then \tgsComputerName = Wscript.Arguments(0) \tgsUseLogFile = Wscript.Arguments(1) else \tgsComputerName = InputBox(&quot;\u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;&quot;) \tgsUseLogFile = InputBox(&quot;\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c log-\u0444\u0430\u0439\u043b \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438?&quot; & VBNewline & &quot;[y\/n]&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;y&quot;) end if  WScript.Echo &quot;* \u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 &quot; & gsComputerName  if lCase(gsUseLogFile) = &quot;y&quot; then \tgbFlag = false \t \tgsLogFilename = &quot;f:\\Log\\&quot; & gsComputerName & &quot;.log&quot;  \tWScript.Echo &quot;* \u0424\u0430\u0439\u043b \u0436\u0443\u0440\u043d\u0430\u043b\u0430 &quot; & gsLogFilename  \tset objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)  \tif not objFSO.FileExists(gsLogFilename) then \t\tWScript.Echo &quot;* \u0424\u0430\u0439\u043b\u0430 \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u043d\u0435\u0442. \u0421\u043e\u0437\u0434\u0430\u0435\u0442\u0441\u044f...&quot; \t\tset objTextFileWriteLog = objFSO.OpenTextFile(gsLogFilename, 8, True) \t\tobjTextFileWriteLog.writeLine &quot;n&quot; \t\tobjTextFileWriteLog.close \t\tWScript.Echo &quot;* \u0421\u043e\u0437\u0434\u0430\u043d \u0443\u0441\u043f\u0435\u0448\u043d\u043e.&quot; \tend if  \tset objTextFileOpen = objFSO.OpenTextFile(gsLogFilename, 1)  \tdo until objTextFileOpen.AtEndOfStream \t\trecord = trim(objTextFileOpen.Readline) \t\tif record = &quot;n&quot; then \t\t\tWScript.Echo &quot;* \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 \u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u043b\u0441\u044f \u0440\u0430\u043d\u0435\u0435.&quot; \t\t\tif fuPing(gsComputerName) then \t\t\t\t'fuListInstalledSoftware gsComputerName \t\t\t\tgbFlag = true \t\t\t\t \t\t\t\tif fuBackup(gsComputerName) then \t\t\t\t\tWScript.Sleep 15000 ' &lt;- 15 \u0441\u0435\u043a\u0443\u043d\u0434 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0438 \u0434\u043b\u044f \u0431\u0435\u043a\u0430\u043f\u0430 \t\t\t\t\tfuUploadEvents gsComputerName \t\t\t\t\twscript.sleep 10000 \t\t\t\tend if \t\t\tend if \t\telseif record = &quot;y&quot; then \t\t\tWScript.Echo &quot;* \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 &quot; & gsComputerName & &quot; \u0443\u0436\u0435 \u0437\u0430\u043a\u0430\u0447\u0430\u043d\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440.&quot; \t\telse  \t\t\tWScript.Echo &quot;* \u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435 &quot; & gsComputerName & &quot; \u0432 log-\u0444\u0430\u0439\u043b\u0435.&quot; \t\tend if \tloop  \tobjTextFileOpen.close  \tif gbFlag then \t\tset objTextFileWriteLog = objFSO.OpenTextFile(gsLogFilename, 2, True) \t\tobjTextFileWriteLog.writeLine &quot;y&quot; \t\tobjTextFileWriteLog.close \t\tWScript.Echo &quot;* \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0437\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b.&quot; \t\t \t\t'MsgBox &quot;\u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 &quot; & gsComputerName & &quot; \u0432 \u0441\u0435\u0442\u0438!&quot;, vbInformation, &quot;\u0412\u043d\u0438\u043c\u0430\u043d\u0438\u0435&quot; \tend if else \t'if fuPing(gsComputerName) then \t\tif fuBackup(gsComputerName) then \t\t\tWScript.Sleep 15000 ' &lt;- 15 \u0441\u0435\u043a\u0443\u043d\u0434 \u0437\u0430\u0434\u0435\u0440\u0436\u043a\u0438 \u0434\u043b\u044f \u0431\u0435\u043a\u0430\u043f\u0430 \t\t\tfuUploadEvents gsComputerName \t\t\twscript.sleep 60000 \t\tend if \t'end if end if  wscript.sleep 1000  function fuPing(NetworkDevice) \tlBoo = false \tset objPING = GetObject(&quot;winmgmts:{impersonationLevel=impersonate}&quot;)._ \t\tExecQuery (&quot;select * from Win32_PingStatus where address ='&quot; & NetworkDevice & &quot;'&quot;)  \tFor Each PING In objPing \t\tif PING.StatusCode = 0 then \t\t\tWScript.Echo &quot;* \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440 &quot; & NetworkDevice & &quot; \u0432 \u0441\u0435\u0442\u0438!&quot;  \t\t\tlBoo = true \t\telse \t\t\tWScript.Echo &quot;* \u041a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043d\u0435\u0442 \u0432 \u0441\u0435\u0442\u0438.&quot; \t\tend if \tnext \t \tfuPing = lBoo end function   function fuBackup(lsComputername) \tlsEvtBackupFilename = &quot;c:\\&quot; & lsComputername & &quot;.evt&quot; \tlsEvtBackupFilenameRemote = &quot;\\\\&quot; & lsComputername & &quot;\\c$\\&quot; & lsComputername & &quot;.evt&quot; \tlbFlag = false \t \t'WScript.Echo &quot;* lsEvtBackupFilename: &quot; & lsEvtBackupFilename \t'WScript.Echo &quot;* lsEvtBackupFilenameRemote: &quot; & lsEvtBackupFilenameRemote \t \tset lObjFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;) \t \tif lObjFSO.FileExists(lsEvtBackupFilenameRemote) then \t\tWScript.Echo &quot;* \u0424\u0430\u0439\u043b \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0443\u0436\u0435 \u0435\u0441\u0442\u044c. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439...&quot; \t\tlbFlag = true \telse \t\tWscript.Echo &quot;* \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0435 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435...&quot; \t\t \t\tSet objWMIService = GetObject(&quot;winmgmts:{impersonationLevel=impersonate,(Backup)}!\\\\&quot; & lsComputername & &quot;\\root\\cimv2&quot;)  \t\tSet colLogFiles = objWMIService.ExecQuery (&quot;Select * from Win32_NTEventLogFile where LogFileName='Security'&quot;)  \t\tFor Each objLogfile in colLogFiles \t\t\terrBackupLog = objLogFile.BackupEventLog(lsEvtBackupFilename) \t\t\tIf errBackupLog = 0 Then         \t\t\t\tWscript.Echo &quot;* \u0420\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0435 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043e \u0443\u0441\u043f\u0435\u0448\u043d\u043e.&quot; \t\t\t\tlbFlag = true \t\t\tElse \t\t\t\tWscript.Echo &quot;* \u0420\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0435 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043e.&quot; \t\t\tEnd If \t\tNext \tend if \t \tfuBackup = lbFlag end function   function fuUploadEvents(lsComputername) \tWScript.Echo &quot;* \u0417\u0430\u043f\u0443\u0449\u0435\u043d\u0430 \u0437\u0430\u043a\u0430\u0447\u043a\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440...&quot; \tgsCompName = lCase(lsComputername)  \tgsTableName = fuGetTableName(gsCompName) \tgsTableName = uCase(gsTableName)   \tSet WshShell = CreateObject(&quot;WScript.Shell&quot;)  \tgsRunCmd = &quot;f:\\Computer\\mo7.bat &quot; & gsCompName & &quot; &quot; & gsTableName  \tWScript.Echo &quot;* \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u0430: '&quot; & gsRunCmd & &quot;'&quot; \tWshShell.Run gsRunCmd end function   function fuGetTableName(lsCompName) \tlsTmp = lsCompName \t \tif InStr(lsTmp, &quot;-&quot;) then \t\tlsTmp = Replace(lsTmp, &quot;-&quot;, &quot;_&quot;) \tend if \t \tfuGetTableName = lsTmp end function   <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  mo7.bat \u0434\u0435\u043b\u0430\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435:  <\/p>\n<ul>\n<li>\u0417\u0430\u0431\u0438\u0440\u0430\u0435\u0442 evt-\u0444\u0430\u0439\u043b \u0441 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440.<\/li>\n<li>\u041f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u044b\u0432\u0430\u0435\u0442 evt-\u0444\u0430\u0439\u043b \u0432 evtx.<\/li>\n<li>\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 evtx-\u0444\u0430\u0439\u043b\u0430 \u0437\u0430\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442 \u043d\u0430 SQL Server.<\/li>\n<li>\u0411\u0435\u043a\u0430\u043f\u0438\u0442 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 evt-\u0444\u0430\u0439\u043b \u0432 \u043f\u0430\u043f\u043a\u0443 Logi_ForReports (\u0432\u0434\u0440\u0443\u0433 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0441\u043e\u0442\u0440\u0451\u0442 \u0441\u0432\u043e\u0439 \u0436\u0443\u0440\u043d\u0430\u043b, \u0430 \u0443 \u043d\u0430\u0441 \u043a\u043e\u043f\u0438\u044f \u0435\u0441\u0442\u044c).<\/li>\n<li>\u0423\u0434\u0430\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 evtx-\u0444\u0430\u0439\u043b.<\/li>\n<li>\u0424\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 sql-\u0437\u0430\u043f\u0440\u043e\u0441 \u043a SQL Server\u2019\u0443.<\/li>\n<li>\u0423\u0434\u0430\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b (\u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0442\u043b\u0430\u0434\u043a\u0438 \u0438\u043b\u0438 \u0434\u043b\u044f \u0438\u0437\u0443\u0447\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043a\u0440\u0438\u043f\u0442\u0430, \u044d\u0442\u043e\u0442 \u0440\u0430\u0437\u0434\u0435\u043b \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c).<\/li>\n<li>\u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0435\u0442 \u043e\u0442\u0447\u0451\u0442\u044b \u0432 \u043f\u0430\u043f\u043a\u0443 CheckComps.<\/li>\n<\/ul>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">mo7.bat<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"dos\">@echo off  @set WDate=%date:~-10%  @echo * \u0416\u0443\u0440\u043d\u0430\u043b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 %1 (Windows 7)... move \\\\%1\\c$\\%1.evt f:\\Logs\\ @echo * \u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u0412\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u043d\u0432\u0435\u0440\u0442\u0430\u0446\u0438\u044f evt \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0432 evtx... wevtutil epl f:\\Logs\\%1.evt f:\\Logs\\%1.evtx \/lf:true @echo * \u041a\u043e\u043d\u0432\u0435\u0440\u0442\u0430\u0446\u0438\u044f \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0430.  @echo * \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u0438\u0437 \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043a\u0430\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440. \u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: f:\\Logs\\%1.evtx LogParser.exe file:&quot;f:\\Computer\\get_info_from_log7.sql&quot;?source=f:\\Logs\\%1.evtx+output_file=%2 -i:EVT -o:SQL -server:&quot;SQL-SRV\\SEC&quot; -database:quickly -driver:&quot;SQL Server&quot; -createTable:ON @echo * \u041f\u0440\u043e\u0446\u0435\u0441\u0441 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d.  @echo * \u0416\u0443\u0440\u043d\u0430\u043b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0432... move f:\\Logs\\%1.evt f:\\Logi_ForReports\\%1_%WDate%_sec.evt @echo * \u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e. \u0418\u043c\u044f \u0430\u0440\u0445\u0438\u0432\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 'f:\\Logi_ForReports\\%1_%WDate%_sec.evtx'   @echo * \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 sql-\u0437\u0430\u043f\u0440\u043e\u0441\u0430... cscript &quot;F:\\Computer\\create_SQL_full7.vbs&quot; %1 1 \/\/nologo @echo * \u0421\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 sql-\u0437\u0430\u043f\u0440\u043e\u0441\u0430... SQLCMD.EXE -S SQL-SRV\\SEC -d quickly -E -i f:\\Computer\\%1-1.sql -o &quot;f:\\Computer\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.csv&quot; -W -R -s &quot;;&quot; -w 4000 @echo * \u0412\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u044e \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0444\u0430\u0439\u043b\u044b \u043e\u0442\u0447\u0435\u0442\u043e\u0432... cscript F:\\Computer\\update_result_file7.vbs &quot;f:\\Computer\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.csv&quot; \/\/nologo @echo * \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432... del f:\\Logs\\%1.evtx del f:\\Computer\\%1-1.sql del &quot;f:\\Computer\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.csv&quot; @echo * \u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo * \u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432-\u043e\u0442\u0447\u0435\u0442\u043e\u0432... move &quot;f:\\Computer\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.xls&quot; &quot;f:\\CheckComps\\%1. \u0417\u0430\u043f\u0443\u0441\u043a \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.xls&quot; @echo * \u041f\u0435\u0440\u0435\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e.  @echo on <\/code><\/pre>\n<p><em>\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435<\/em><br \/>  \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u0432 \u0431\u0430\u0442\u043d\u0438\u043a\u0435 \u043d\u0443\u0436\u043d\u043e \u0431\u0443\u0434\u0435\u0442 SQLCMD.EXE \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u00abc:\\Program Files\\Microsoft SQL Server\\100\\Tools\\Binn\\SQLCMD.EXE\u00bb, \u0430 LogParser.exe \u043d\u0430 \u00abc:\\Program Files (x86)\\Log Parser 2.2\\LogParser.exe\u00bb (\u0438\u043b\u0438 \u00abc:\\Program Files\\Log Parser 2.2\\LogParser.exe\u00bb).<br \/>  \u0418\u043c\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0441 SQL Server\u2019\u043e\u043c SQL-SRV, \u0438\u043c\u044f \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430 SEC \u0438 \u0438\u043c\u044f \u0431\u0430\u0437\u044b quickly. \u0417\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u043d\u0430 \u0441\u0432\u043e\u0438.   <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">get_info_from_log7.sql<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"sql\">SELECT RecordNumber as id,  \teventid as eId,  \tTimeGenerated as Tg,  \t--resolve_sid(sid) as UserName,  \tEXTRACT_TOKEN(Strings, 1, '|') as UserName, \tcomputername as Computer,  \tEXTRACT_TOKEN(Strings, 4, '|') as image_id, \tEXTRACT_TOKEN(Strings, 5, '|') as image, \tEXTRACT_TOKEN(Strings, 6, '|') as name into %output_file%  FROM %source% where (EventID in (4688;4689)) and ( (TO_UPPERCASE(resolve_sid(sid)) &lt;&gt; 'NT AUTHORITY\\NETWORK SERVICE') and (TO_UPPERCASE(resolve_sid(sid)) &lt;&gt; 'NT AUTHORITY\\SYSTEM')) and TimeGenerated &gt;= TO_TIMESTAMP('01.01.2013 00:00:00','dd.MM.yyyy hh:mm:ss') order by recordnumber desc <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">create_SQL_full7.vbs<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"vbscript\">'on error resume next  if Wscript.Arguments.Count = 1 then \tgsComputerName = Wscript.Arguments(0) \tgsSQLtype = &quot;1&quot; elseif Wscript.Arguments.Count = 2 then \tgsComputerName = Wscript.Arguments(0) \tgsSQLtype = Wscript.Arguments(1) else \tgsComputerName = InputBox(&quot;\u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;&quot;) \tgsSQLtype = InputBox(&quot;\u0422\u0438\u043f sql-\u0437\u0430\u043f\u0440\u043e\u0441\u0430?&quot; & VBNewline & &quot;[1 - \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439, 2 - \u043f\u043e\u043b\u043d\u044b\u0439, 3 - \u043e\u0431\u0430]&quot;, &quot;\u0412\u0432\u0435\u0434\u0438\u0442\u0435&quot;, &quot;1&quot;) end if  set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;)  if gsSQLtype = &quot;1&quot; then \tfuCreateSQLFile gsComputerName, &quot;1&quot; elseif gsSQLtype = &quot;2&quot; then \tfuCreateSQLFile gsComputerName, &quot;2&quot; elseif gsSQLtype = &quot;3&quot; then \tfuCreateSQLFile gsComputerName, &quot;1&quot; \tfuCreateSQLFile gsComputerName, &quot;2&quot; end if  function fuGetTableName(lsCompName) \tlsTmp = lsCompName \t \tif InStr(lsTmp, &quot;-&quot;) then \t\tlsTmp = Replace(lsTmp, &quot;-&quot;, &quot;_&quot;) \tend if \t \tfuGetTableName = lsTmp end function   sub fuCreateSQLFile(lsComputerName, lsSQLtype) \tif lsSQLtype = &quot;1&quot; then \t\tlsTemplateFilename = &quot;f:\\Computer\\template-short7.sql&quot; \telseif gsSQLtype = &quot;2&quot; then \t\tlsTemplateFilename = &quot;f:\\Computer\\template-full7.sql&quot; \tend if \t \tlsLogFilename = &quot;f:\\Computer\\&quot; & lsComputerName & &quot;-&quot; & lsSQLtype & &quot;.sql&quot; \tlsTableName = fuGetTableName(lsComputerName)  \t'WScript.Echo &quot;* \u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430 &quot; & lsComputerName \t'WScript.Echo &quot;* \u0418\u043c\u044f \u0442\u0430\u0431\u043b\u0438\u0446\u044b &quot; & lsTableName \t'WScript.Echo &quot;* \u0418\u043c\u044f \u0444\u0430\u0439\u043b\u0430 sql-\u0437\u0430\u043f\u0440\u043e\u0441\u0430 &quot; & lsLogFilename  \tif not objFSO.FileExists(lsLogFilename) then \t\tset objTextFileWriteLog = objFSO.OpenTextFile(lsLogFilename, 8, True) \telse \t\tset objTextFileWriteLog = objFSO.OpenTextFile(lsLogFilename, 2, True) \tend if \t \tSet objTextFileOpen = objFSO.OpenTextFile(lsTemplateFilename, 1) \t \tdo until objTextFileOpen.AtEndOfStream \t\trecord = objTextFileOpen.Readline \t\tif InStr(record, &quot;WARNING__TABLE_NAME_FOR_CHANGE&quot;) then \t\t\trecord = Replace(record, &quot;WARNING__TABLE_NAME_FOR_CHANGE&quot;, lsTablename) \t\tend if \t\tobjTextFileWriteLog.writeLine record \tloop   \tobjTextFileOpen.Close \tobjTextFileWriteLog.Close end sub  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">template-short7.sql<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"sql\">SELECT TOP (100) PERCENT Computer AS [\u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430], UserName AS [\u0423\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c], program AS \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430, start_time AS [\u0412\u0440\u0435\u043c\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430],         stop_time AS [\u0412\u0440\u0435\u043c\u044f \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f], dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) \/ 3600))         + ':' + dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) % 3600 \/ 60))         + ':' + dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) % 3600 % 60)) AS \u0414\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c FROM   (SELECT r.Computer, s.UserName, r.programID, r.id AS R_ID, MIN(s.id) AS S_ID, r.program, r.Tg AS start_time, MIN(s.Tg) AS stop_time         FROM   (SELECT  id, eId, Tg, UserName, Computer, image_id AS programID, image AS program \t\t\t\tFROM    dbo.WARNING__TABLE_NAME_FOR_CHANGE \t\t\t\tWHERE   (eId = 4688) \t\t\t\tAND     (Tg &gt; CONVERT(DATETIME, '2013-01-01 00:00:00.000', 102)) \t\t\t\tAND     image not like '%.scr') AS r  \t\t\t\tINNER JOIN \t\t\t\t(SELECT  id, eId, Tg, UserName, Computer, image AS programID, name AS program \t\t\t\tFROM    dbo.WARNING__TABLE_NAME_FOR_CHANGE \t\t\t\tWHERE   (eId = 4689) \t\t\t\tAND     name not like '%.scr') AS s  \t\t\t\tON r.programID = s.programID AND r.program = s.program AND r.UserName = s.UserName AND r.id &lt;= s.id          GROUP BY r.Computer, s.UserName, r.programID, r.id, r.program, r.Tg) AS DERIVEDTBL UNION ALL SELECT  TOP (100) PERCENT Computer AS [\u0418\u043c\u044f \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430], UserName AS [\u0423\u0447\u0435\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c], program AS \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430, start_time AS [\u0412\u0440\u0435\u043c\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430],          stop_time AS [\u0412\u0440\u0435\u043c\u044f \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f], dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) \/ 3600))          + ':' + dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) % 3600 \/ 60))          + ':' + dbo.FU_GET_FULL_QTY_TEST(CONVERT(VARCHAR, DATEDIFF(SECOND, start_time, stop_time) % 3600 % 60)) AS \u0414\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c FROM    (SELECT r.Computer, s.UserName, r.programID, r.id AS R_ID, MIN(s.id) AS S_ID, r.program, r.Tg AS start_time, MIN(s.Tg) AS stop_time          FROM   (SELECT  id, eId, Tg, UserName, Computer, image_id AS programID, image AS program \t\t\t\t FROM    dbo.WARNING__TABLE_NAME_FOR_CHANGE                  WHERE   (eId = 4688)                  AND     (Tg &gt; CONVERT(DATETIME, '2013-01-01 00:00:00.000', 102)) \t\t\t\t AND     image like '%.scr') AS r  \t\t\t\t INNER JOIN                 (SELECT  id, eId, Tg, UserName, Computer, image AS programID, name AS program                  FROM    dbo.WARNING__TABLE_NAME_FOR_CHANGE                  WHERE   (eId = 4689) \t\t\t\t AND     name like '%.scr') AS s  \t\t\t\t ON r.programID = s.programID AND r.program = s.program AND r.id &lt;= s.id          GROUP BY r.Computer, s.UserName, r.programID, r.id, r.program, r.Tg) AS DERIVEDTBL2 ORDER BY '\u0412\u0440\u0435\u043c\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430' DESC  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">update_result_file7.vbs<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"vbscript\">'on error resume next  if Wscript.Arguments.Count = 1 then \tgsFileName = Wscript.Arguments(0) \tgsFileNameRes = fuRemoveExtention(gsFileName) & &quot;.xls&quot; elseif Wscript.Arguments.Count = 2 then \tgsFileName = Wscript.Arguments(0) \tgsFileNameRes = Wscript.Arguments(1) else \tgsFileName = InputBox(&quot;\u0424\u0430\u0439\u043b \u0434\u043b\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f&quot;, &quot;\u0412\u0432\u043e\u0434&quot;, &quot;&quot;) \tgsFileNameRes = InputBox(&quot;\u0424\u0430\u0439\u043b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0430&quot;, &quot;\u0412\u0432\u043e\u0434&quot;, fuRemoveExtention(gsFileName) & &quot;.xls&quot;) end if  sgSimbolSplit = &quot;;&quot; gsSimbolSplitFields = vbTab  Set objFSO = CreateObject(&quot;Scripting.FileSystemObject&quot;) Set objTextFileOpen = objFSO.OpenTextFile(gsFileName, 1)  if not objFSO.FileExists(gsFileName) then \twscript.echo &quot;\u0418\u0441\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0434\u043b\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u0442, \u0432\u044b\u0445\u043e\u0436\u0443!&quot; \tobjTextFileOpen.Close \tWscript.Quit end if  if not objFSO.FileExists(gsFileNameRes) then \tset objTextFileWriteRes = objFSO.OpenTextFile(gsFileNameRes, 8, True) else \tset objTextFileWriteRes = objFSO.CreateTextFile(gsFileNameRes, True) end if  do until objTextFileOpen.AtEndOfStream \trecord = objTextFileOpen.Readline \t \tif ((InStr(record, &quot;--------&quot;)) or (Len(record) = 0) or (InStr(record, &quot;\u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043e \u0441\u0442\u0440\u043e\u043a&quot;)) or (InStr(record, &quot;rows affected&quot;))) then \t\t'wscript.echo &quot;\u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044e \u0441\u0442\u0440\u043e\u043a\u0443: '&quot; & record & &quot;'&quot; \telse \t\tif InStr(record, sgSimbolSplit) then \t\t\trecordRes = Replace(record, sgSimbolSplit, gsSimbolSplitFields) \t\telse \t\t\trecordRes = record \t\tend if \t\t \t\tobjTextFileWriteRes.writeLine recordRes \tend if loop   objTextFileWriteRes.Close objTextFileOpen.Close  WScript.Echo &quot;\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u043e! \u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0444\u0430\u0439\u043b &quot; & gsFileNameRes  function fuRemoveExtention(lsFilename) \tlRes = lsFilename \tif InStr(lsFilename, &quot;.&quot;) then \t\tlRes = Left(lsFilename, Len(lsFilename)-4) \tend if \tfuRemoveExtention = lRes end function  <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  \u041d\u0430 SQL Server\u2019\u0435 \u043d\u0430\u0434\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e FU_GET_FULL_QTY_TEST:  <\/p>\n<div class=\"spoiler\"><b class=\"spoiler_title\">FU_GET_FULL_QTY_TEST<\/b><\/p>\n<div class=\"spoiler_text\">\n<pre><code class=\"sql\">USE [quickly] GO \/****** Object:  UserDefinedFunction [dbo].[FU_GET_FULL_QTY_TEST]    Script Date: 12\/03\/2013 13:03:43 ******\/ SET ANSI_NULLS ON GO SET QUOTED_IDENTIFIER ON GO  CREATE FUNCTION [dbo].[FU_GET_FULL_QTY_TEST] (@short_qty varchar(255)) RETURNS varchar(255) AS BEGIN DECLARE @retMsg varchar(255) set @retMsg = @short_qty if len(@short_qty) &lt;= 1 set @retMsg = '0' + @retMsg RETURN (@retMsg) END <\/code><\/pre>\n<p>  <\/div>\n<\/div>\n<p>  \u0410\u0440\u0445\u0438\u0432 \u0441\u043e \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u043c\u043e\u0436\u043d\u043e <a href=\"http:\/\/yadi.sk\/d\/ZHTqZWsFDjEfW\">\u0441\u043a\u0430\u0447\u0430\u0442\u044c \u0442\u0443\u0442<\/a>.<br \/>  \u0417\u043d\u0430\u044e, \u043a\u0430\u0436\u0435\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u043e \u0431\u0430\u0442\u043d\u0438\u043a\u043e\u0432 \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432. \u041d\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0434\u0438\u043d \u0440\u0430\u0437 \u043d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u043e\u0442\u043e\u043c.<\/p>\n<p>  \u0418 \u043a\u0442\u043e \u043a\u0430\u043a \u0434\u0435\u043b\u0430\u0435\u0442 \u043e\u0442\u0447\u0451\u0442 \u043f\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439? \u041f\u043e\u0434\u0435\u043b\u0438\u0442\u0435\u0441\u044c.    \t<\/p>\n<div class=\"clear\"><\/div>\n<\/p><\/div>\n<p> \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"http:\/\/habrahabr.ru\/post\/202914\/\"> http:\/\/habrahabr.ru\/post\/202914\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"content html_format\">   \t\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!<br \/>  \u041e\u0442\u0447\u0451\u0442 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0430 \u0441\u0432\u043e\u0451\u043c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435, \u043a\u0440\u0430\u0439\u043d\u0435 \u0432\u0430\u0436\u0435\u043d. \u0421 \u043c\u043d\u043e\u0433\u0438\u0445 \u0442\u043e\u0447\u0435\u043a \u0437\u0440\u0435\u043d\u0438\u044f. \u041e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. <br \/>  \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0430\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0445\u0440\u0430\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0441\u0440\u0435\u0434\u0430 Windows. \u0412 \u0418\u043d\u0435\u0442\u0435 \u0433\u043e\u0442\u043e\u0432\u043e\u0433\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043d\u0435 \u043d\u0430\u0448\u0451\u043b, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0441\u0434\u0435\u043b\u0430\u043b \u0441\u0432\u043e\u044e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e.<br \/>  \u0421\u043a\u0440\u0438\u043f\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041d\u0430 \u0432\u044b\u0445\u043e\u0434\u0435 \u0438\u043c\u0435\u0435\u043c \u043d\u0430\u0431\u043e\u0440 \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043e\u0442\u0447\u0451\u0442\u0430\u043c\u0438 \u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c.<br \/>  \u041a\u0430\u0440\u0442\u0438\u043d\u043a\u0430 \u0434\u043b\u044f \u043f\u0440\u0438\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u044f:<br \/>  <img decoding=\"async\" src=\"http:\/\/habr.habrastorage.org\/post_images\/155\/a2c\/8a1\/155a2c8a1d1b836b72d51769a2c1191d.png\"\/>  <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-202914","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/202914","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=202914"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/202914\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=202914"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=202914"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=202914"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}