Jump to content
Sign in to follow this  
roman

Writing to Eventlog with own Source

Recommended Posts

roman

Hi

I am not very good with AutoIt. I would like to write some Windows Eventlog entries. That works except that i don't know how to set my own event source for the entry. Setting the event id is no problem. So, how do i write an event log entry e.g. with source = "MySource" and ID = "10000"?

Any hints?

Kind regards,

Roman.

Share this post


Link to post
Share on other sites
PsaltyDS

When you get a handle to the event log with _Event__Open(), the second parameter identifies the source. The Event Source needs to exist in the registry under the key for the log it will appear in. This key would make the source "MyCustomItem" show up in the System log: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\System\MyCustomItem

You only have to create the source registry key if want the entry to go to a particular Event Log, other than the Application log (i.e. System Event Log). Using this source when it doesn't exist in the registry will create the entry in the Application log by default, with the source of "DingleBerries":

$hEventLog = _EventLog__Open("", "DingleBerries")

:D


Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law

Share this post


Link to post
Share on other sites
roman

Thanks a lot for your help.

A further question: The UDFs "_Eventlog__Report" last parameter is an array "$aData". I don't know how to handle with this parameter? What is the meaning for it?

Regards,

Roman.

Share this post


Link to post
Share on other sites
PsaltyDS

It's an array of additional app-specific binary\INT32 information for the error, and not always used. Just declare "Global $aData[1]=[0]" and pass $aData for it. Or test it with "Global $aData[4]=[3,1,2,3]" to see the difference it makes in the log entry. Note that [0] = count in the array.

#include <EventLog.au3>

Global $hEventLog, $aEmpty[1] = [0], $aData[4]=[3, 0xA1, 0xB2, 0xC3]

$hEventLog = _EventLog__Open("", "Application Error")
_EventLog__Report($hEventLog, 1, "None", 1000, "", "AutoIt3 event without data", $aEmpty)
_EventLog__Report($hEventLog, 1, "None", 1000, "", "AutoIt3 event with $aData", $aData)
_EventLog__Close ($hEventLog)

:D


Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law

Share this post


Link to post
Share on other sites
TekWeis

I have begun trying to utilize this UDF.

The above information is really helpful. My question; is it possible to add to the message section of an event? I am able to create an event entry with an ID #, and a source name, but cannot figure out how to add to the message area of an event.

 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.