This should have been added to the documentation:
Eventlog scanning is disabled for windows 2000 machines!
The reason for this is that in over 70% of the tested machines (2000 Pro and Server) WMI crashes, the server runs out of memory, ...
The reason is the bad implementation of this WMI class in Windows 2000.
