Exporting Event Logs

ca143508 · October 26, 2008

Guys,

Is there a way using autoit to automate the exporting of a particular event log (system for example) to a txt (TAB Delimited)? I have seem the UDFs but I want the entire log. Not a single entry.....

Cheers

Mike.

martin · October 26, 2008

Guys,
Is there a way using autoit to automate the exporting of a particular event log (system for example) to a txt (TAB Delimited)? I have seem the UDFs but I want the entire log. Not a single entry.....
Cheers
Mike.

It's not very clear to me what you want to do, but if you want to build up a series of items for a report and then write them to a file in one go you can just add each item to a string, with tabs and @CR where needeed, and write that string to a file when you have finished.

A log file would normally write a line at a time if it was important to know what had been happening even if the program terminated unexpectedly.

ca143508 · October 26, 2008

I want a way to export the Windows event log to a tab delimited file without any user interaction.... I know you can do it from the Event viewer but that requires some interaction from the end user.

SoulA · October 26, 2008

Here is some code you can adapt

#Include <EventLog.au3>

$file = FileOpen("eventlog.txt", 2)
If $file = -1 Then Exit

$hEventLog = _EventLog__Open ("", "Application")
$count = _EventLog__Count($hEventLog)

For $i = 0 to $count
    $aEvent = _EventLog__Read($hEventLog, True, False)
    FileWrite($file, "Result ............: " & $aEvent[0] & @CRLF)
    FileWrite($file, "Record number .....: " & $aEvent[1])
    FileWrite($file, "Submitted .........: " & $aEvent[2] & " " & $aEvent[3] & @CRLF)
    FileWrite($file, "Generated .........: " & $aEvent[4] & " " & $aEvent[5] & @CRLF)
    FileWrite($file, "Event ID ..........: " & $aEvent[6] & @CRLF)
    FileWrite($file, "Type ..............: " & $aEvent[8] & @CRLF)
    FileWrite($file, "Category ..........: " & $aEvent[9] & @CRLF)
    FileWrite($file, "Source ............: " & $aEvent[10] & @CRLF)
    FileWrite($file, "Computer ..........: " & $aEvent[11] & @CRLF)
    FileWrite($file, "Username ..........: " & $aEvent[12] & @CRLF)
    FileWrite($file, "Description .......: " & $aEvent[13] & @CRLF)
    FileWrite($file, @CRLF & @CRLF)
Next

FileClose($file)

ca143508 · October 26, 2008

Perfect. Thanks for your help.

bacobampense · May 19, 2009

I took what you guys have done and modified it to display as a web page.

but i need some help getting only the errors and warnings.

and if possible only the last 24-72 Hours.

can some one help?

#Include <EventLog.au3>

#include <array.au3>

#include <file.au3>

While 1

Sleep(3600000) ;($time) ; 1 sec = 1000; 1 Min = 60,000; 1 hr = 3,600,000;~ sleep(43200000) ; 43,200,000 = 12 Hours

_System()

WEnd

func _system()

$file = iniread ("I:\Speedtest\connect.ini","Dashboard","File1","Not Found")

FileOpen ($file, 2)

FileWrite($file, "<html>" & @CRLF)

FileWrite($file, "<head>"& @CRLF)

FileWrite($file, "<H1>Server Status</H1>" & @CRLF)

FileWrite($file, "<H2>Date:"& @YEAR&"/"&@mon&"/"&@MDAY&" Time:"&@HOUR&":"&@MIN&"</H2>" & @CRLF)

FileWrite($file, "</head>"& @CRLF)

FileWrite($file,'<div><table width="100%" border="1" cellpadding="2" cellspacing="2" bgcolor="#ffffff"><tr valign="top">')

FileWrite($file, "<td>Result</td>"&@CRLF)

FileWrite($file, "<td>Record number</td>"&@CRLF)

FileWrite($file, "<td>Submitted</td>"&@CRLF)

FileWrite($file, "<td>Generated</td>"&@CRLF)

FileWrite($file, "<td>Event ID</td>"&@CRLF)

FileWrite($file, "<td>Type</td>"&@CRLF)

FileWrite($file, "<td>Category</td>"&@CRLF)

FileWrite($file, "<td>Source</td>"&@CRLF)

FileWrite($file, "<td>Computer</td>"&@CRLF)

FileWrite($file, "<td>Username</td>"&@CRLF)

FileWrite($file, "<td>Description</td>"&@CRLF)

FileWrite($file, "</tr>" & @CRLF)

If $file = -1 Then Exit

$hEventLog = _EventLog__Open ("", "System")

$count = _EventLog__Count($hEventLog)

For $i = 0 to $count

$aEvent = _EventLog__Read($hEventLog, True, False)

FileWrite($file, '<tr valign="top>' & @CRLF)

FileWrite($file, "<td>" & $aEvent[0] & "</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[1]&"</td>")

FileWrite($file, "<td>" & $aEvent[2] & " " & $aEvent[3] & "</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[4] & " " & $aEvent[5] & "</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[6] & "</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[8] & "</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[9] & "</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[10] & "</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[11] & "</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[12] &"</td>"&@CRLF)

FileWrite($file, "<td>" & $aEvent[13] & "</td>"&@CRLF)

FileWrite($file, "</tr>" & @CRLF)

FileWrite($file, "</Table>" & @CRLF)

FileWrite($file, "</Body>" & @CRLF)

FileWrite($file, "</html>" & @CRLF)

FileClose($file)

endfunc

skysel · June 4, 2009

@SoulA:

Just what I needed. Great example

Edited June 4, 2009 by skysel

skysel · June 4, 2009

While this is a good script, I cannot figure out why is it taking ~50% of CPU? Can I somehow lower the CPU usage?

99ojo · June 4, 2009

I took what you guys have done and modified it to display as a web page.
but i need some help getting only the errors and warnings.
and if possible only the last 24-72 Hours.

can some one help?

#Include <EventLog.au3>
#include <array.au3>
#include <file.au3>

While 1
Sleep(3600000) ;($time) ; 1 sec = 1000; 1 Min = 60,000; 1 hr = 3,600,000;~ sleep(43200000) ; 43,200,000 = 12 Hours
_System()
WEnd
func _system()
$file = iniread ("I:\Speedtest\connect.ini","Dashboard","File1","Not Found")
FileOpen ($file, 2)
FileWrite($file, "<html>" & @CRLF)
FileWrite($file, "<head>"& @CRLF)
FileWrite($file, "<H1>Server Status</H1>" & @CRLF)
FileWrite($file, "<H2>Date:"& @YEAR&"/"&@mon&"/"&@MDAY&" Time:"&@HOUR&":"&@MIN&"</H2>" & @CRLF)
FileWrite($file, "</head>"& @CRLF)
FileWrite($file,'<div><table width="100%" border="1" cellpadding="2" cellspacing="2" bgcolor="#ffffff"><tr valign="top">')
FileWrite($file, "<td>Result</td>"&@CRLF)
FileWrite($file, "<td>Record number</td>"&@CRLF)
FileWrite($file, "<td>Submitted</td>"&@CRLF)
FileWrite($file, "<td>Generated</td>"&@CRLF)
FileWrite($file, "<td>Event ID</td>"&@CRLF)
FileWrite($file, "<td>Type</td>"&@CRLF)
FileWrite($file, "<td>Category</td>"&@CRLF)
FileWrite($file, "<td>Source</td>"&@CRLF)
FileWrite($file, "<td>Computer</td>"&@CRLF)
FileWrite($file, "<td>Username</td>"&@CRLF)
FileWrite($file, "<td>Description</td>"&@CRLF)
FileWrite($file, "</tr>" & @CRLF)
If $file = -1 Then Exit
$hEventLog = _EventLog__Open ("", "System")
$count = _EventLog__Count($hEventLog)
For $i = 0 to $count
$aEvent = _EventLog__Read($hEventLog, True, False)
FileWrite($file, '<tr valign="top>' & @CRLF)
FileWrite($file, "<td>" & $aEvent[0] & "</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[1]&"</td>")
FileWrite($file, "<td>" & $aEvent[2] & " " & $aEvent[3] & "</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[4] & " " & $aEvent[5] & "</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[6] & "</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[8] & "</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[9] & "</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[10] & "</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[11] & "</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[12] &"</td>"&@CRLF)
FileWrite($file, "<td>" & $aEvent[13] & "</td>"&@CRLF)
FileWrite($file, "</tr>" & @CRLF)
Next
FileWrite($file, "</div>" & @CRLF)
FileWrite($file, "</Table>" & @CRLF)
FileWrite($file, "</Body>" & @CRLF)
FileWrite($file, "</html>" & @CRLF)
FileClose($file)
endfunc

Hi,

1) but i need some help getting only the errors and warnings:

For $i = 0 to $count
     if $aEvent [7] = 1 or $aEvent [7] = 2 Then
        your code above
    EndIf
Next

2) Look Helpfile for _NowDate and _NowTime. You have to code some if statements to check, wether the eventlog entries are older then 24 or 72 hours. The timestamps eventlog are $aEvent [2] (Date) and $aEvent [3] (Time).

;-))

Stefan

Edited June 4, 2009 by 99ojo

99ojo · June 4, 2009

While this is a good script, I cannot figure out why is it taking ~50% of CPU? Can I somehow lower the CPU usage?

Hi,

just put a Sleep (50) before the Next.

;-))

Stefan

Sign In

Exporting Event Logs

Recommended Posts

ca143508

martin

ca143508

SoulA

ca143508

bacobampense

skysel

skysel

99ojo

99ojo

Create an account or sign in to comment

Create an account

Sign in

Recently Browsing 0 members

Browse

AutoIt Resources

Release

Beta