Check Windows application event logs on Exchange server and read messages by event code to show Exchange database whitespace.

arrComputers = Array("comp1","comp2")

For Each strComputer In arrComputers

strOutput = "Time,Server,Database,WhiteSpace"

Set objWMIService = GetObject("winmgmts:" & strComputer & " ootCIMV2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent Where Logfile='Application' and Eventcode = '1221'")

For each objEvent in ColItems

strMessage = objEvent.Message

 StartWhiteSpaceDBName = Instr(1,strMessage,"database",1)
 EndWhiteSpaceDBName = Instr(1,strMessage,"has",1)
 ReturnDBNameLength = ((EndWhiteSpaceDBName-1)-(StartWhiteSpaceDBName+9))
 strWSDB = Mid(strMessage,(StartWhiteSpaceDBName+9),(ReturnDBNameLength))

 StartWhiteSpaceSize = Instr(1,strMessage,"has",1)
 EndWhiteSpaceSize = Instr(1,strMessage,"megabytes",1)
 ReturnSizeLength = ((EndWhiteSpaceSize-1)-(StartWhiteSpaceSize+4))+10
 strWSSize = Mid(strMessage,(StartWhiteSpaceSize+4),(ReturnSizeLength))

 dtmEventDate = objEvent.TimeWritten
 strWSTime = WMIDateStringToDate(dtmEventDate)

strOutput = strOutput & strWSTime & "," & strComputer & "," & strWSDB & "," & strWSSize

Next

Next

'Echo output for example, better to write text file
Wscript.Echo strOutput

Function WMIDateStringToDate(dtmEventDate)
WMIDateStringToDate = CDate(Mid(dtmEventDate, 7, 2) & "/" & Mid(dtmEventDate, 5, 2) & "/" & Left(dtmEventDate, 4) & " " & Mid (dtmEventDate, 9, 2) & ":" & Mid(dtmEventDate, 11, 2) & ":" & Mid(dtmEventDate, 13, 2))
End Function