How to read system event log

[Roger Linhart]

I was wondering if anyone knows how to read the system event logs on. I'm trying to write a program that will run in the startup folder. It will compare the the time of a particular event in the system event log indicating when the user begins the login process then compare that to the current time to determine how long it took to login. I've read some Microsoft Technet articles for VB, C++ and J# but not sure how to do this in AutoIT.

http://msdn2.microsoft.com/en-us/library/k6b9a7h8.aspx

[GaryFrost]

expandcollapse popup

$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$colItems = ""
$strComputer = "localhost"
$Where_Clause = " WHERE Logfile = 'System' AND SourceName = 'Netlogon'"

$Output=""
$Output = $Output & "Computer: " & $strComputer  & @CRLF
$Output = $Output & "==========================================" & @CRLF
$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\CIMV2")
$colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_NTLogEvent" & $Where_Clause, "WQL", _
                                          $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

If IsObj($colItems) then
   For $objItem In $colItems
      $Output = $Output & "Category: " & $objItem.Category & @CRLF
      $Output = $Output & "CategoryString: " & $objItem.CategoryString & @CRLF
      $Output = $Output & "ComputerName: " & $objItem.ComputerName & @CRLF
      $strData = $objItem.Data(0)
      $Output = $Output & "Data: " & $strData & @CRLF
      $Output = $Output & "EventCode: " & $objItem.EventCode & @CRLF
      $Output = $Output & "EventIdentifier: " & $objItem.EventIdentifier & @CRLF
      $Output = $Output & "EventType: " & $objItem.EventType & @CRLF
      $strInsertionStrings = $objItem.InsertionStrings(0)
      $Output = $Output & "InsertionStrings: " & $strInsertionStrings & @CRLF
      $Output = $Output & "Logfile: " & $objItem.Logfile & @CRLF
      $Output = $Output & "Message: " & $objItem.Message & @CRLF
      $Output = $Output & "RecordNumber: " & $objItem.RecordNumber & @CRLF
      $Output = $Output & "SourceName: " & $objItem.SourceName & @CRLF
      $Output = $Output & "TimeGenerated: " & WMIDateStringToDate($objItem.TimeGenerated) & @CRLF
      $Output = $Output & "TimeWritten: " & WMIDateStringToDate($objItem.TimeWritten) & @CRLF
      $Output = $Output & "Type: " & $objItem.Type & @CRLF
      $Output = $Output & "User: " & $objItem.User & @CRLF
      if Msgbox(1,"WMI Output",$Output) = 2 then ExitLoop
      $Output=""
   Next
Else
   Msgbox(0,"WMI Output","No WMI Objects Found for class: " & "Win32_NTLogEvent" )
Endif


Func WMIDateStringToDate($dtmDate)

    Return (StringMid($dtmDate, 5, 2) & "/" & _
    StringMid($dtmDate, 7, 2) & "/" & StringLeft($dtmDate, 4) _
    & " " & StringMid($dtmDate, 9, 2) & ":" & StringMid($dtmDate, 11, 2) & ":" & StringMid($dtmDate,13, 2))
EndFunc

[Angelia]

Hi!

Would you please give me the syntax to WRITE to the event log?

[MHz]

Hi!

Would you please give me the syntax to WRITE to the event log?

; Adds an event entry to a log file

; Example function call
_LogEvent(0, 'Testing LogEvent')

Exit

Func _LogEvent($iType, $sMessage, $sTarget = @ComputerName)
    ; Adds an event entry to a log file
    ; Type: 0=Success, 1=Error, 2=Warning, 4=Information, 8=Audit_Success 16=Audit_Failure
    Local $oWshShell = ObjCreate("WScript.Shell")
    If Not @error Then
        $oWshShell.LogEvent($iType, $sMessage, $sTarget)
        Return True
    EndIf
EndFunc

[ptrex]

@Angelia

There are many different ways to read or write to the eventlog :

Run("eventcreate /T Error /ID 999 /L Application /D " & "SMART Harddisk Status : ?? ")

Enjoy !!

ptrex

[PaulIA]

There is also a full implementation of the Event Log API in Auto3Lib if none of the above work for you.