Sign in to follow this  
Followers 0
badscript

Problem on writing Eventlogentry

3 posts in this topic

Hi,

I want to write an Eventlogentry with the following code, however i only get Errorcode 87 "the parameter is incorrect" from function "ReportEventA".

Does anyone have an idea?

#include "Array.au3"

Global $EVENTLOG_SUCCESS = 0x0
Global $EVENTLOG_ERROR_TYPE = 0x1
Global $EVENTLOG_WARNING_TYPE = 0x2
Global $EVENTLOG_INFORMATION_TYPE = 0x4
Global $EVENTLOG_AUDIT_SUCCESS = 0x8
Global $EVENTLOG_AUDIT_FAILURE = 0x10

Global $FORMAT_MESSAGE_ALLOCATE_BUFFER = 0x100
Global $FORMAT_MESSAGE_FROM_SYSTEM = 0x1000
Global $LANG_NEUTRAL = 0
Global $SUBLANG_DEFAULT = 0x1
Global $ERROR_BAD_USERNAME = 2202

LogNTEvent ("Information from " & @ScriptName, $EVENTLOG_INFORMATION_TYPE, 1001)

Func LogNTEvent($sString, $iLogType, $iEventID)
    Local $bRC
    Local $iNumStrings
    Local $hEventLog
    Local $hMsgs
    Local $cbStringSize
    Local $dummy
    Local $aTemp
    
    $ADVAPI32=DllOpen ( "advapi32.dll" )
    $KERNEL32=DllOpen ( "kernel32.dll" )
    
; get Eventloghandle
    $aTemp = DllCall($ADVAPI32, "long", "RegisterEventSource", "str" , "", "str", "Application")
    If $aTemp[0] = 0 Then _ShowLastDllError ()
    $hEventLog = $aTemp[0]
    
; calculate messagelenth
    $cbStringSize = StringLen($sString)
    
; Allocate memory
    $aTemp = DllCall($KERNEL32, "long", "GlobalAlloc", "long", 64, "long", $cbStringSize)
    $hMsgs = $aTemp[0]
    
; copy messagestring to memory
    $dummy = DllCall($KERNEL32, "none", "RtlMoveMemory", "long", $hMsgs, "str", $sString, "long", $cbStringSize)
    
    $iNumStrings = 1
; write Eventlogentry
    $result = DllCall($ADVAPI32, "long", "ReportEventA", "long", $hEventLog, "int", $iLogType, "int", 0, "long", $iEventID, "long", 0, "int", $iNumStrings, "long" , $cbStringSize, "long", $hMsgs, "long", $hMsgs)
    If $result[0] = 0 Then _ShowLastDllError ()
    _ArrayDisplay ( $result, "ReportEvent" )

; free allocated memory
    $dummy = DllCall($KERNEL32, "long", "GlobalFree", "long", $hMsgs)
    
; release Eventloghandle
    $dummy = DllCall($ADVAPI32 , "long", "DeregisterEventSource", "long", $hEventLog)
    DllClose ( $ADVAPI32 )
    DllClose ( $KERNEL32 )

EndFunc

Func _ShowLastDllError ()
    Local $buffer = "                                                                                                                                                                                                       "
    $LastErrorCode = DllCall("kernel32.dll", "long", "GetLastError")
    $result = DllCall("kernel32.dll", "long", "FormatMessage", "long", $FORMAT_MESSAGE_FROM_SYSTEM, "int", 0, "long", $LastErrorCode[0], "long", $LANG_NEUTRAL, "str" , $buffer, "long", 200, "long", 0)
    MsgBox(16, "DllError", "Errorcode: " & $result[3] & @LF & $result[5])
EndFunc

I'm bound to say this problem is driving me crasy! :)

Share this post


Link to post
Share on other sites



#3 ·  Posted (edited)

Hi wo0uter,

thanks for response. I replaced "ReportEventA" with "ReportEvent", but i got the same error.

I used "ReportEventA" to call the ANSI supported function directly, in case of "ReportEvent" i dont know is the "..EventA" for ANSI or "..EventW" for Unicode

called.

try and use "ReportEvent" instead of "ReportEventA"

<{POST_SNAPBACK}>

I hope you can understand me, because I'm German and my english is very bad. Edited by badscript

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0