djmunis Posted March 4, 2011 Share Posted March 4, 2011 Hi, I have a problem with eventlog.au3. when I use _eventlog_read() all components of array are ok except description. Sometimes the description do not show how in event viewer. This happens in XP and W7image of error The problem seem caused by _eventlog_read() inv include eventlog.au3 ->> $aEvent[13]=EventLog_DecodeDesc($tEventLog) ->> Local $aStrings = EventLog_DecodeStrings($tEventLog) ->> $sDesc = StringReplace($sDesc, "%" & $iI, $aStrings[$iI]) Func EventLog_DecodeStrings($tEventLog)Local $pEventLog = DllStructGetPtr($tEventLog) Local $iNumStrs = DllStructGetData($tEventLog, "NumStrings") Local $iOffset = DllStructGetData($tEventLog, "StringOffset") ; The data offset is used to calculate buffer sizes. Local $iDataOffset = DllStructGetData($tEventLog, "DataOffset") Local $tBuffer = DllStructCreate("wchar Text& $iDataOffset - $iOffset &?", $pEventLog + $iOffset)Local $aStrings[$iNumStrs + 1] $aStrings[0] = $iNumStrs For $iI = 1 To $iNumStrs$aStrings[$iI] = DllStructGetData($tBuffer, "Text") $iOffset += StringLen($aStrings[$iI]) + 1 $tBuffer = DllStructCreate("wchar Text& $iDataOffset - $iOffset &?", $pEventLog + $iOffset) Next Return $aStrings EndFunc ;==>EventLog_DecodeStrings Can you help me? best regardsNotificator Plus v1.0.zip Link to comment Share on other sites More sharing options...
MvGulik Posted March 5, 2011 Share Posted March 5, 2011 (edited) Never used the event logging UDF myself, so don't now mush about it and probably will not be able to help.But. Are you only using it to do logging to/from a server ... Or are you also having this problem when doing some logging locally. (I don't have a server setup I could use to test with in case its only server-use related.) Edited March 5, 2011 by iEvKI3gv9Wrkd41u "Straight_and_Crooked_Thinking" : A "classic guide to ferreting out untruths, half-truths, and other distortions of facts in political and social discussions.""The Secrets of Quantum Physics" : New and excellent 2 part documentary on Quantum Physics by Jim Al-Khalili. (Dec 2014) "Believing what you know ain't so" ... Knock Knock ... Link to comment Share on other sites More sharing options...
djmunis Posted March 5, 2011 Author Share Posted March 5, 2011 the querys were locally Link to comment Share on other sites More sharing options...
MvGulik Posted March 5, 2011 Share Posted March 5, 2011 (edited) Sometimes the description do not show how in event viewer. This happens in XP and W7Seems more like some parts of the description don't make it when Reading then with _EventLog__Read(). (instead of no description at all)Some part of the description field are probably linked items, that need some special handling. Will see about updating your Report. But as I'm not at home with Win-DLL'ing thats the best I can do at the moment.... Was reading the description the only thing, or was there also a problem with writing some description data? YepSometimes the description do not show how in event viewer.Seems similar, as in some parts don't make it. ... Edited March 5, 2011 by iEvKI3gv9Wrkd41u "Straight_and_Crooked_Thinking" : A "classic guide to ferreting out untruths, half-truths, and other distortions of facts in political and social discussions.""The Secrets of Quantum Physics" : New and excellent 2 part documentary on Quantum Physics by Jim Al-Khalili. (Dec 2014) "Believing what you know ain't so" ... Knock Knock ... Link to comment Share on other sites More sharing options...
djmunis Posted March 6, 2011 Author Share Posted March 6, 2011 Some part of the description field are probably linked items, that need some special handling. you are rigth. If you do not replace with "$sDesc = StringReplace($sDesc, "%" & $iI, $aStrings[$iI])" in eventlog.au3, __EventLog_DecodeDesc($tEventLog)the Msbox show %1 instead name of service and %2 instead chinese characters. I do not know work with dll functions that used to generate "$aStrings". Thanks for your answer Link to comment Share on other sites More sharing options...
MvGulik Posted March 6, 2011 Share Posted March 6, 2011 PS: Apply the following change. It should correct your reading problem. (although there might be some issues with it I'm not aware of.)Func __EventLog_DecodeStrings($tEventLog) <snip> ;~ $iOffset += StringLen($aStrings[$iI]) + 1 ;; disable this line. $iOffset += StringLen($aStrings[$iI])*2 + 2 ;; and add this line. <snip> "Straight_and_Crooked_Thinking" : A "classic guide to ferreting out untruths, half-truths, and other distortions of facts in political and social discussions.""The Secrets of Quantum Physics" : New and excellent 2 part documentary on Quantum Physics by Jim Al-Khalili. (Dec 2014) "Believing what you know ain't so" ... Knock Knock ... Link to comment Share on other sites More sharing options...
djmunis Posted March 6, 2011 Author Share Posted March 6, 2011 (edited) PS: Apply the following change. It should correct your reading problem. (although there might be some issues with it I'm not aware of.) Func __EventLog_DecodeStrings($tEventLog) <snip> ;~ $iOffset += StringLen($aStrings[$iI]) + 1 ;; disable this line. $iOffset += StringLen($aStrings[$iI])*2 + 2 ;; and add this line. <snip> This seems that works fine. I saw here also, and MVG suggested more changes Func __EventLog_DecodeUserName($tEventLog) <snip> If IsArray($aAcctInfo) Then ... ;~ Return $aAcctInfo[1] ;; org, contains computer name. need user type Return $aAcctInfo[0] ;; change: user type. <snip> Func __EventLog_DecodeComputer($tEventLog) <snip> Local $tBuffer ;~ $iOffset += StringLen(__EventLog_DecodeSource($tBuffer)) + 1 ;; org, wrong count, + trigers a dllstruc error. $iOffset += StringLen(__EventLog_DecodeSource($tEventLog))*2 + 2 ;; changed, count + $tBuffer -> $tEventLog <snip> Thanks Edited March 6, 2011 by djmunis Link to comment Share on other sites More sharing options...
Factfinder Posted March 16, 2011 Share Posted March 16, 2011 Thanks to both of you a couple of problems on my end is solved. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now