eventlog description

[djmunis]

Hi, I have a problem with eventlog.au3. when I use _eventlog_read() all components of array are ok except description. Sometimes the description do not show how in event viewer. This happens in XP and W7

image of error

The problem seem caused by _eventlog_read() inv include eventlog.au3 ->> $aEvent[13]=EventLog_DecodeDesc($tEventLog) ->> Local $aStrings = EventLog_DecodeStrings($tEventLog) ->> $sDesc = StringReplace($sDesc, "%" & $iI, $aStrings[$iI])

Func EventLog_DecodeStrings($tEventLog)

Local $pEventLog = DllStructGetPtr($tEventLog)

Local $iNumStrs = DllStructGetData($tEventLog, "NumStrings")

Local $iOffset = DllStructGetData($tEventLog, "StringOffset")

; The data offset is used to calculate buffer sizes.

Local $iDataOffset = DllStructGetData($tEventLog, "DataOffset")

Local $tBuffer = DllStructCreate("wchar Text& $iDataOffset - $iOffset &?", $pEventLog + $iOffset)

Local $aStrings[$iNumStrs + 1]

$aStrings[0] = $iNumStrs

For $iI = 1 To $iNumStrs

$aStrings[$iI] = DllStructGetData($tBuffer, "Text")

$iOffset += StringLen($aStrings[$iI]) + 1

$tBuffer = DllStructCreate("wchar Text& $iDataOffset - $iOffset &?", $pEventLog + $iOffset)

Next

Return $aStrings

EndFunc ;==>EventLog_DecodeStrings

Can you help me?

best regards

Notificator Plus v1.0.zip

[MvGulik]

Never used the event logging UDF myself, so don't now mush about it and probably will not be able to help.

But. Are you only using it to do logging to/from a server ... Or are you also having this problem when doing some logging locally. (I don't have a server setup I could use to test with in case its only server-use related.)

Edited March 5, 2011 by iEvKI3gv9Wrkd41u

[djmunis]

the querys were locally

[MvGulik]

Sometimes the description do not show how in event viewer. This happens in XP and W7

Seems more like some parts of the description don't make it when Reading then with _EventLog__Read(). (instead of no description at all)

Some part of the description field are probably linked items, that need some special handling.

Will see about updating your Report. But as I'm not at home with Win-DLL'ing thats the best I can do at the moment.

... Was reading the description the only thing, or was there also a problem with writing some description data? Yep

Sometimes the description do not show how in event viewer.

Seems similar, as in some parts don't make it. ... Edited March 5, 2011 by iEvKI3gv9Wrkd41u

[djmunis]

Some part of the description field are probably linked items, that need some special handling.

you are rigth. If you do not replace with "$sDesc = StringReplace($sDesc, "%" & $iI, $aStrings[$iI])" in eventlog.au3, __EventLog_DecodeDesc($tEventLog)the Msbox show %1 instead name of service and %2 instead chinese characters.

I do not know work with dll functions that used to generate "$aStrings".

Thanks for your answer

[MvGulik]

PS: Apply the following change. It should correct your reading problem. (although there might be some issues with it I'm not aware of.)

Func __EventLog_DecodeStrings($tEventLog)
<snip>
;~      $iOffset += StringLen($aStrings[$iI]) + 1 ;; disable this line.
        $iOffset += StringLen($aStrings[$iI])*2 + 2 ;; and add this line.
<snip>

[djmunis]

PS: Apply the following change. It should correct your reading problem. (although there might be some issues with it I'm not aware of.)

Func __EventLog_DecodeStrings($tEventLog)
<snip>
;~      $iOffset += StringLen($aStrings[$iI]) + 1 ;; disable this line.
        $iOffset += StringLen($aStrings[$iI])*2 + 2 ;; and add this line.
<snip>

This seems that works fine. I saw here also, and MVG suggested more changes

Func __EventLog_DecodeUserName($tEventLog)
<snip>
    If IsArray($aAcctInfo) Then ...
;~          Return $aAcctInfo[1] ;; org, contains computer name. need user type
        Return $aAcctInfo[0] ;; change: user type.
<snip>

Func __EventLog_DecodeComputer($tEventLog)
<snip>
    Local $tBuffer
;~  $iOffset += StringLen(__EventLog_DecodeSource($tBuffer)) + 1 ;; org, wrong count, + trigers a dllstruc error.
    $iOffset += StringLen(__EventLog_DecodeSource($tEventLog))*2 + 2 ;; changed, count + $tBuffer -> $tEventLog
<snip>

Thanks

Edited March 6, 2011 by djmunis

[Factfinder]

Thanks to both of you a couple of problems on my end is solved.