Sign in to follow this  
Followers 0
Roger Linhart

How to read system event log

6 posts in this topic

I was wondering if anyone knows how to read the system event logs on. I'm trying to write a program that will run in the startup folder. It will compare the the time of a particular event in the system event log indicating when the user begins the login process then compare that to the current time to determine how long it took to login. I've read some Microsoft Technet articles for VB, C++ and J# but not sure how to do this in AutoIT.

http://msdn2.microsoft.com/en-us/library/k6b9a7h8.aspx

Share this post


Link to post
Share on other sites



$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$colItems = ""
$strComputer = "localhost"
$Where_Clause = " WHERE Logfile = 'System' AND SourceName = 'Netlogon'"

$Output=""
$Output = $Output & "Computer: " & $strComputer  & @CRLF
$Output = $Output & "==========================================" & @CRLF
$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\CIMV2")
$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent" & $Where_Clause, "WQL", _
                                          $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

If IsObj($colItems) then
   For $objItem In $colItems
      $Output = $Output & "Category: " & $objItem.Category & @CRLF
      $Output = $Output & "CategoryString: " & $objItem.CategoryString & @CRLF
      $Output = $Output & "ComputerName: " & $objItem.ComputerName & @CRLF
      $strData = $objItem.Data(0)
      $Output = $Output & "Data: " & $strData & @CRLF
      $Output = $Output & "EventCode: " & $objItem.EventCode & @CRLF
      $Output = $Output & "EventIdentifier: " & $objItem.EventIdentifier & @CRLF
      $Output = $Output & "EventType: " & $objItem.EventType & @CRLF
      $strInsertionStrings = $objItem.InsertionStrings(0)
      $Output = $Output & "InsertionStrings: " & $strInsertionStrings & @CRLF
      $Output = $Output & "Logfile: " & $objItem.Logfile & @CRLF
      $Output = $Output & "Message: " & $objItem.Message & @CRLF
      $Output = $Output & "RecordNumber: " & $objItem.RecordNumber & @CRLF
      $Output = $Output & "SourceName: " & $objItem.SourceName & @CRLF
      $Output = $Output & "TimeGenerated: " & WMIDateStringToDate($objItem.TimeGenerated) & @CRLF
      $Output = $Output & "TimeWritten: " & WMIDateStringToDate($objItem.TimeWritten) & @CRLF
      $Output = $Output & "Type: " & $objItem.Type & @CRLF
      $Output = $Output & "User: " & $objItem.User & @CRLF
      if Msgbox(1,"WMI Output",$Output) = 2 then ExitLoop
      $Output=""
   Next
Else
   Msgbox(0,"WMI Output","No WMI Objects Found for class: " & "Win32_NTLogEvent" )
Endif


Func WMIDateStringToDate($dtmDate)

    Return (StringMid($dtmDate, 5, 2) & "/" & _
    StringMid($dtmDate, 7, 2) & "/" & StringLeft($dtmDate, 4) _
    & " " & StringMid($dtmDate, 9, 2) & ":" & StringMid($dtmDate, 11, 2) & ":" & StringMid($dtmDate,13, 2))
EndFunc


SciTE for AutoItDirections for Submitting Standard UDFs

 

Don't argue with an idiot; people watching may not be able to tell the difference.

 

Share this post


Link to post
Share on other sites

Hi!

Would you please give me the syntax to WRITE to the event log?

Share this post


Link to post
Share on other sites

Hi!

Would you please give me the syntax to WRITE to the event log?

; Adds an event entry to a log file

; Example function call
_LogEvent(0, 'Testing LogEvent')

Exit

Func _LogEvent($iType, $sMessage, $sTarget = @ComputerName)
    ; Adds an event entry to a log file
    ; Type: 0=Success, 1=Error, 2=Warning, 4=Information, 8=Audit_Success 16=Audit_Failure
    Local $oWshShell = ObjCreate("WScript.Shell")
    If Not @error Then
        $oWshShell.LogEvent($iType, $sMessage, $sTarget)
        Return True
    EndIf
EndFunc

Share this post


Link to post
Share on other sites

Share this post


Link to post
Share on other sites

There is also a full implementation of the Event Log API in Auto3Lib if none of the above work for you.


Auto3Lib: A library of over 1200 functions for AutoIt

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0