Modify

Opened 8 years ago

Closed 6 years ago

#2119 closed Feature Request (Rejected)

"_EventLog__Open" can not access additional Windows 7/2008 eventlogs

Reported by: Trash Owned by:
Milestone: Component: Standard UDFs
Version: Severity: None
Keywords: Cc:

Description

Hi,

it seems that Autoit can only access the "standard" eventlogs (the 3-4 eventlogs since Windows 2000: Application, System, Security) and not the much more eventlogs of Vista/7/2008. :-(

Here is the example from helpfile for "_EventLog_Read". I only changed the name of the eventlog to "Microsoft-Windows-PrintService/Operational".
If you try this (first activate this log "Operational" in your eventviewer and print something, to get events), then you get only entries from the "Application" log:

#include <GuiConstantsEx.au3>
#include <EventLog.au3>
Global $iMemo
_Main()
Func _Main()
Local $hEventLog, $hGUI, $aEvent
; Create GUI
$hGUI = GUICreate("EventLog", 400, 300)
$iMemo = GUICtrlCreateEdit("", 2, 2, 396, 300, 0)
GUICtrlSetFont($iMemo, 9, 400, 0, "Courier New")
GUISetState()
; Read most current event record
$hEventLog = _EventLog__Open("", "Microsoft-Windows-PrintService/Operational")
$aEvent = _EventLog__Read($hEventLog, True, False) ; read last event
;~  $hEventLog = _EventLog__Open("", "System")
;~  $aEvent = _EventLog__Read($hEventLog)
;~  $aEvent = _EventLog__Read($hEventLog, True, False)
MemoWrite("Result ............: " & $aEvent[ 0])
MemoWrite("Record number .....: " & $aEvent[ 1])
MemoWrite("Submitted .........: " & $aEvent[ 2] & " " & $aEvent[ 3])
MemoWrite("Generated .........: " & $aEvent[ 4] & " " & $aEvent[ 5])
MemoWrite("Event ID ..........: " & $aEvent[ 6])
MemoWrite("Type ..............: " & $aEvent[ 8])
MemoWrite("Category ..........: " & $aEvent[ 9])
MemoWrite("Source ............: " & $aEvent[10])
MemoWrite("Computer ..........: " & $aEvent[11])
MemoWrite("Username ..........: " & $aEvent[12])
MemoWrite("Description .......: " & $aEvent[13])
_EventLog__Close($hEventLog)

; Loop until user exits
Do
Until GUIGetMsg() = $GUI_EVENT_CLOSE
EndFunc   ;==>_Main
; Write a line to the memo control
Func MemoWrite($sMessage)
GUICtrlSetData($iMemo, $sMessage & @CRLF, 1)
EndFunc   ;==>MemoWrite

This problem is mentioned in some threads:
http://www.autoitscript.com/forum/topic/103883-reading-from-additional-vistawin7-event-logs/
http://www.autoitscript.com/forum/topic/135043-how-to-read-windows-7-eventlog-such-as-setup/

Please add support for this special eventlogs of windows 7/2008.

Regards
Trash

Attachments (0)

Change History (2)

comment:1 Changed 8 years ago by trancexx

  • Component changed from AutoIt to Standard UDFs

comment:2 Changed 6 years ago by Jon

  • Resolution set to Rejected
  • Status changed from new to closed

Guidelines for posting comments:

  • You cannot re-open a ticket but you may still leave a comment if you have additional information to add.
  • In-depth discussions should take place on the forum.

For more information see the full version of the ticket guidelines here.

Add Comment

Modify Ticket

Action
as closed The ticket will remain with no owner.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.