_EventLog and $fForward

[ant2ne]

Help file says...

$fForward If True, the log is read in date order. If False, the log is read in reverse date order.

Regardles if $fForward = true or false, this thing reads from the oldest date to the youngest date in the event log. I want it to read the newest date first.

do 
$fRead = False
$fForward = True
$fOffset = $Count
    $aEvent = _EventLog__Read($hEventLog,$fRead,$fForward,$fOffset)
until $count = 100

What am I doing wrong?

Edited February 10, 2009 by ant2ne

[PsaltyDS]

Help file says...

Regardles if $fForward = true or false, this thing reads from the oldest date to the youngest date in the event log. I want it to read the newest date first.

do 
$fRead = False
$fForward = True
$fOffset = $Count
    $aEvent = _EventLog__Read($hEventLog,$fRead,$fForward,$fOffset)
until $count = 100

What am I doing wrong?

Nothing there updates $count. Also the offset is more like a record number and the oldest record in the log is not 1, if the log has overflowed since being created. This should show you the first (oldest) records going forward, and then the last (newest) records in reverse:

#include <EventLog.au3>
#include <Array.au3>

$hAppEvt = _EventLog__Open("", "Application")
$iOldest = _EventLog__Oldest($hAppEvt)
ConsoleWrite("Debug: $iOldest = " & $iOldest & @LF)
$iNewest = $iOldest + _EventLog__Count($hAppEvt) - 1
ConsoleWrite("Debug: $iNewest = " & $iNewest & @LF)

; Read oldest and next 10 going forward
For $n = $iOldest To $iOldest + 10
    If $n = $iOldest Then 
        $avAppEvt = _EventLog__Read($hAppEvt, False, True, $iOldest); Start from oldest index
    Else
        $avAppEvt = _EventLog__Read($hAppEvt, True, True); Read next entry forward
    EndIf
    _ArrayDisplay($avAppEvt, "Index = " & $n)
Next

; Read newest and previous 10 in reverse
For $n = $iNewest To $iNewest - 10 Step -1
    If $n = $iNewest Then 
        $avAppEvt = _EventLog__Read($hAppEvt, False, False, $iNewest); Start from newest index
    Else
        $avAppEvt = _EventLog__Read($hAppEvt, True, False); Read next entry forward
    EndIf
    _ArrayDisplay($avAppEvt, "Index = " & $n)
Next

_EventLog__Close($hAppEvt); <== Be sure to close handle

I do hit a snag though. On my computer, this causes an AutoIt crash, then works, then crash, then works, etc. Each time I run it, it alternates between working and crashing AutoIt. Weird.

Edit: Close the handle to the event log to avoid issues (demo script edited).

Edited February 11, 2009 by PsaltyDS

[ant2ne]

I got it to work, I think.

I had a section where $count = $count +1. What I did is added $Count = _EventLog__Count ($hEventLog) and then $count = $count - 1. It seems to work, but it doesn't seem to exit and has created a run away process. I gotta figure out where that error is. But at least I'm counting backwards now. Thanks

[PsaltyDS]

I got it to work, I think.

I had a section where $count = $count +1. What I did is added $Count = _EventLog__Count ($hEventLog) and then $count = $count - 1. It seems to work, but it doesn't seem to exit and has created a run away process. I gotta figure out where that error is. But at least I'm counting backwards now. Thanks

Make sure you close the handle to the event log with _EventLog__CLose(). That fixed my crashing demo (edited above).

[ant2ne]

I got my script to work GREAT on win XP. but it isn't working on win 2000 (server). It is almost as though it can not find the log files. Is there some difference that I'm not aware of?