John117 Posted July 11, 2007 Share Posted July 11, 2007 I would like to pull all System Event viewer popups to a gui scroll box. (Just the first 4 lines of each popup event) Path = Contol panel - Admin Tools - Event Viewer - System - Source = Application popup Can this be done with autoit? Link to comment Share on other sites More sharing options...
evilertoaster Posted July 11, 2007 Share Posted July 11, 2007 (edited) The Event viewer logs are stored in your WINDOWS\system32\config directory where there is a seperate .evt file for each type fo log avilable on your system (eg AppEvent.Evt). But the data contains some binary information that you'd have to parse though (like the event viewer does) if you wanted to make use of it. Alterntively I beleive there is the option to save the event viewers current events as a .csv file which is a bit more readable. Edited July 11, 2007 by evilertoaster Link to comment Share on other sites More sharing options...
John117 Posted July 11, 2007 Author Share Posted July 11, 2007 yeah, was just looking for a way to display messages recieved from messenger in a messenger gui I am building. -would only be useful if it could get the info automatically Thanks Link to comment Share on other sites More sharing options...
PsaltyDS Posted July 11, 2007 Share Posted July 11, 2007 You can access the Event Logs using COM objects and query them for whatever you want.For instance, this post, by a rakishly good looking bird in another topic... Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law Link to comment Share on other sites More sharing options...
John117 Posted July 17, 2007 Author Share Posted July 17, 2007 You can access the Event Logs using COM objects and query them for whatever you want.For instance, this post, by a rakishly good looking bird in another topic... Excellent! Thanks for the step in the right direction!How might one modify this code to produce a list of only $output $= message . . . . . . Showing all messages Code belowCODE#include <GuiConstants.au3>#include <date.au3>$Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND SourceName = 'Application Popup' AND EventCode = 26"$objWMIService = ObjGet("winmgmts:{impersonationLevel=impersonate,(Security)}!\\" & @ComputerName & "\root\cimv2")If IsObj($objWMIService) Then $colItems = $objWMIService.ExecQuery ($Query_Clause) If IsObj($colItems) Then For $objEvent In $colItems $Output = "" ;$Output &= "Category: " & $objEvent.Category & @CRLF ;$Output &= "Computer Name: " & $objEvent.ComputerName & @CRLF ;$Output &= "Event Code: " & $objEvent.EventCode & @CRLF $Output &= "Message: " & $objEvent.Message & @CRLF ;$Output &= "Record Number: " & $objEvent.RecordNumber & @CRLF ;$Output &= "Source Name: " & $objEvent.SourceName & @CRLF ;$Output &= "Time Written: " & $objEvent.TimeWritten & @CRLF ;$Output &= "Event Type: " & $objEvent.Type & @CRLF ;$Output &= "User: " & $objEvent.User & @CRLF If MsgBox(64 + 4, "Entry Found:", $Output & @CRLF & @CRLF & "Continue?") = 7 Then Exit Next Else MsgBox(16, "Error", "$colItems is not an object.") EndIfElse MsgBox(16, "Error", "$objWMIService is not an object.")EndIf Link to comment Share on other sites More sharing options...
PsaltyDS Posted July 17, 2007 Share Posted July 17, 2007 Just move the $Output = "" line to just above the For/Next loop, and move the MsgBox() that displays the results to just after the For/Next loop. Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law Link to comment Share on other sites More sharing options...
John117 Posted July 17, 2007 Author Share Posted July 17, 2007 Excellent! Thanks! Link to comment Share on other sites More sharing options...
John117 Posted July 18, 2007 Author Share Posted July 18, 2007 (edited) To take this a step futher. How would one only include message discriptions that start with Application Popup: Messenger Service : "All the rest of the message goes here" A wildcard on the query? (and discription = Application Popup: Messenger Service : *) ??? Edited July 18, 2007 by Hatcheda Link to comment Share on other sites More sharing options...
John117 Posted July 18, 2007 Author Share Posted July 18, 2007 (edited) trying this . . . CODE$Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND SourceName = 'Application Popup' AND EventCode = '26' AND Discription = 'Application popup: Messenger Service '" Getting nowhere yet . . . swaped Discription for message -No go Edited July 18, 2007 by Hatcheda Link to comment Share on other sites More sharing options...
PsaltyDS Posted July 18, 2007 Share Posted July 18, 2007 To take this a step futher.How would one only include message discriptions that start with Application Popup: Messenger Service : "All the rest of the message goes here"A wildcard on the query? (and discription = Application Popup: Messenger Service : *)???The $Query_Clause variable is formatted in WQL (SQL for WMI). Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law Link to comment Share on other sites More sharing options...
John117 Posted July 18, 2007 Author Share Posted July 18, 2007 The $Query_Clause variable is formatted in WQL (SQL for WMI). Ok, done a quick read. I don't follow how to referance the Message value.For example, where does it tell you to use SourceName instead of Source . . .Event Code instead of EventID . . . . Link to comment Share on other sites More sharing options...
PsaltyDS Posted July 18, 2007 Share Posted July 18, 2007 (edited) Ok, done a quick read. I don't follow how to referance the Message value. For example, where does it tell you to use SourceName instead of Source . . . Event Code instead of EventID . . . . From the link in the original script posting to Win32_NTLogEvent, SourceName plus EventIdentifier is the preferred way to reference a unique message. You can use EventCode, but it's just the lower 16-bit half of the 32-bit EventIdentifier, and may ignore some unique bits in the upper half (the smaller EventCode is the one shown in the EventView GUI). There is no property called "Discription" (especially not spelled that way). Use "Message" instead. I don't know that you can use '=' for a partial match or with wild cards in WQL, you might need the 'LIKE' operator. $Query_Clause = "Select * FROM Win32_NTLogEvent WHERE Logfile = 'System' AND SourceName = 'Application Popup' AND EventCode = '26' AND Message LIKE 'Application popup: Messenger Service%'" Edited July 18, 2007 by PsaltyDS Valuater's AutoIt 1-2-3, Class... Is now in Session!For those who want somebody to write the script for them: RentACoder"Any technology distinguishable from magic is insufficiently advanced." -- Geek's corollary to Clarke's law Link to comment Share on other sites More sharing options...
John117 Posted July 18, 2007 Author Share Posted July 18, 2007 Thanks! Your post works and gives me a source for future changes! BTW, yes, my spelling is awesome! Link to comment Share on other sites More sharing options...
ptrex Posted July 19, 2007 Share Posted July 19, 2007 (edited) @allHave a look at the MS LogParserMS LogParserThis will solve the WQL syntax problem, because it uses SQL statements.See example here : Event Log ExamplesSyntax is this :C:\>LogParser "SELECT TimeGenerated, SourceName, EventCategoryName, Message INTO report.txt FROM Security WHERE EventID = 528 AND SID LIKE '%TESTUSER%'" -resolveSIDs:ONEnjoy !!ptrex Edited July 19, 2007 by ptrex Contributions :Firewall Log Analyzer for XP - Creating COM objects without a need of DLL's - UPnP support in AU3Crystal Reports Viewer - PDFCreator in AutoIT - Duplicate File FinderSQLite3 Database functionality - USB Monitoring - Reading Excel using SQLRun Au3 as a Windows Service - File Monitor - Embedded Flash PlayerDynamic Functions - Control Panel Applets - Digital Signing Code - Excel Grid In AutoIT - Constants for Special Folders in WindowsRead data from Any Windows Edit Control - SOAP and Web Services in AutoIT - Barcode Printing Using PS - AU3 on LightTD WebserverMS LogParser SQL Engine in AutoIT - ImageMagick Image Processing - Converter @ Dec - Hex - Bin -Email Address Encoder - MSI Editor - SNMP - MIB ProtocolFinancial Functions UDF - Set ACL Permissions - Syntax HighLighter for AU3ADOR.RecordSet approach - Real OCR - HTTP Disk - PDF Reader Personal Worldclock - MS Indexing Engine - Printing ControlsGuiListView - Navigation (break the 4000 Limit barrier) - Registration Free COM DLL Distribution - Update - WinRM SMART Analysis - COM Object Browser - Excel PivotTable Object - VLC Media Player - Windows LogOnOff Gui -Extract Data from Outlook to Word & Excel - Analyze Event ID 4226 - DotNet Compiler Wrapper - Powershell_COM - New Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now