Modify

Opened 14 years ago

Closed 13 years ago

#2119 closed Feature Request (Rejected)

"_EventLog__Open" can not access additional Windows 7/2008 eventlogs

Reported by: Trash Owned by:
Milestone: Component: Standard UDFs
Version: Severity: None
Keywords: Cc:

Description

Hi,

it seems that Autoit can only access the "standard" eventlogs (the 3-4 eventlogs since Windows 2000: Application, System, Security) and not the much more eventlogs of Vista/7/2008. :-(

Here is the example from helpfile for "_EventLog_Read". I only changed the name of the eventlog to "Microsoft-Windows-PrintService/Operational".
If you try this (first activate this log "Operational" in your eventviewer and print something, to get events), then you get only entries from the "Application" log:

#include <GuiConstantsEx.au3>
#include <EventLog.au3>
Global $iMemo
_Main()
Func _Main()
Local $hEventLog, $hGUI, $aEvent
; Create GUI
$hGUI = GUICreate("EventLog", 400, 300)
$iMemo = GUICtrlCreateEdit("", 2, 2, 396, 300, 0)
GUICtrlSetFont($iMemo, 9, 400, 0, "Courier New")
GUISetState()
; Read most current event record
$hEventLog = _EventLog__Open("", "Microsoft-Windows-PrintService/Operational")
$aEvent = _EventLog__Read($hEventLog, True, False) ; read last event
;~  $hEventLog = _EventLog__Open("", "System")
;~  $aEvent = _EventLog__Read($hEventLog)
;~  $aEvent = _EventLog__Read($hEventLog, True, False)
MemoWrite("Result ............: " & $aEvent[ 0])
MemoWrite("Record number .....: " & $aEvent[ 1])
MemoWrite("Submitted .........: " & $aEvent[ 2] & " " & $aEvent[ 3])
MemoWrite("Generated .........: " & $aEvent[ 4] & " " & $aEvent[ 5])
MemoWrite("Event ID ..........: " & $aEvent[ 6])
MemoWrite("Type ..............: " & $aEvent[ 8])
MemoWrite("Category ..........: " & $aEvent[ 9])
MemoWrite("Source ............: " & $aEvent[10])
MemoWrite("Computer ..........: " & $aEvent[11])
MemoWrite("Username ..........: " & $aEvent[12])
MemoWrite("Description .......: " & $aEvent[13])
_EventLog__Close($hEventLog)

; Loop until user exits
Do
Until GUIGetMsg() = $GUI_EVENT_CLOSE
EndFunc   ;==>_Main
; Write a line to the memo control
Func MemoWrite($sMessage)
GUICtrlSetData($iMemo, $sMessage & @CRLF, 1)
EndFunc   ;==>MemoWrite

This problem is mentioned in some threads:
http://www.autoitscript.com/forum/topic/103883-reading-from-additional-vistawin7-event-logs/
http://www.autoitscript.com/forum/topic/135043-how-to-read-windows-7-eventlog-such-as-setup/

Please add support for this special eventlogs of windows 7/2008.

Regards
Trash

Attachments (0)

Change History (2)

comment:1 by trancexx, 14 years ago

Component: AutoItStandard UDFs

comment:2 by Jon, 13 years ago

Resolution: Rejected
Status: newclosed

Modify Ticket

Action
as closed The ticket will remain with no owner.

Add Comment


E-mail address and name can be saved in the Preferences .
 
Note: See TracTickets for help on using tickets.