Yes, that's what I used to use in the past, but it has its issues too. WMI is more reliable, but is really slow for large logs. I found some VB & vbs scripts on the web to run Win32_NTLogEvent in asynchronous mode, but I've been having trouble converting it to Perl. The temporary solution for me is just to allow the scheduled job to run. The job is taking 10 hours.

Once I give myself a crash course in vbs I'll have to rewrite the program and hopefully it will run much faster.

Mitch