_EventLog__Open does not open "Setup"

[stg68]

I have no problem with "System"

Any ideas will be appreciated

#Include <EventLog.au3>

$file = FileOpen("EventLog3.txt", 2)

If $file = -1 Then Exit

$hEventLog = _EventLog__Open ("", "Setup")

$count = _EventLog__Count($hEventLog)

For $i = 0 to $count

$aEvent = _EventLog__Read($hEventLog, True, False)

If $aEvent[0] <> 'False' then ContinueLoop

FileWrite($file, "* " &$aEvent[8] & " " & $aEvent[4] & " " & $aEvent[5] &" " & "<Source> " & $aEvent[10] & " " & "<EventID> " & $aEvent[6] &" " & "<Username> " & $aEvent[12] & @CRLF)

FileWrite($file, "<Description> " & $aEvent[13] & @CRLF & @CRLF & @CRLF)

Next

FileClose($file)

[lowray1975]

Which OS are you testing this on? I just tried you code (without modification) on Windows XP and it worked perfectly. If it's Vista or 7 try adding #RequireAdmin.

Edited May 24, 2012 by lowray1975

[BrewManNH]

That doesn't work on XP lowray1975, because XP doesn't have a Setup eventlog.

It's actually reading the System log file instead. on Vista and 7 it is reading from the Application log file.

[stg68]

#RequireAdmin did the trick for (Win 7). Thank you so much!

However, _EventLog__Read [13] - Event Description shows kind of not readable string e.g.

KB26765625112Installed0x0WindowsUpdateAgent

By looking into event viewer it shows for the same record this:

Package KB2676562 was successfully changed to the Installed state.

Any ideas will be appreciated!

[Kevinsyel]

I wrote something like this in C# a while back, and the Vista unit I was testing the code on Always seemed to crash when it checked the Setup event logs. However, when I ran the code on a Win7 system, I didn't encounter any crashes, and it accessed the event log just fine. I think certain OSs are finicky with the logs the allow you to access, even if the OS has the log in it

[lowray1975]

@stg68 - Excellent, glad I could help!

@BrewManNH - Crap, I didn't pick up on that - good catch and thank you!

[BrewManNH]

@BrewManNH - Crap, I didn't pick up on that - good catch and thank you!

It caught me out too when I ran this until I started looking at what was being read in, found out that the count return was the number of events in the Application log and not my Setup log.

BTW, the #RequireAdmin didn't work for me on Win7. I'm still getting the Application logs instead of setup, not sure why.

[stg68]

Here is what happened on my WIN7 two machines:

1-st machine

It did not work initially. I found a trick by creating the following reg key:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetserviceseventlogsetup

And then I run my script without adding #RequireAdmin. It worked.

Then, I deleted the reg key and got suggestion to add #RequireAdmin. I tried and it worked again..

NOW regardless of reg key AND/OR #RequireAdmin existance my script works all the time

2-nd machine.

I cannot make my script work with #RequireAdmin without reg key creation.

Conclusion:

reg key creation makes my script work without #RequireAdmin specified. However, I do not prefer to create and delete any registries.

Any other suggestions will be appreciated.