id	summary	reporter	owner	description	type	status	milestone	component	version	severity	resolution	keywords	cc
2119	"""_EventLog__Open"" can not access additional Windows 7/2008 eventlogs"	Trash		"Hi,

it seems that Autoit can only access the ""standard"" eventlogs (the 3-4 eventlogs since Windows 2000: Application, System, Security) and not the much more eventlogs of Vista/7/2008. :-(

Here is the example from helpfile for ""_EventLog_Read"". I only changed the name of the eventlog to ""Microsoft-Windows-PrintService/Operational"".
If you try this (first activate this log ""Operational"" in your eventviewer and print something, to get events), then you get only entries from the ""Application"" log:

{{{
#include <GuiConstantsEx.au3>
#include <EventLog.au3>
Global $iMemo
_Main()
Func _Main()
Local $hEventLog, $hGUI, $aEvent
; Create GUI
$hGUI = GUICreate(""EventLog"", 400, 300)
$iMemo = GUICtrlCreateEdit("""", 2, 2, 396, 300, 0)
GUICtrlSetFont($iMemo, 9, 400, 0, ""Courier New"")
GUISetState()
; Read most current event record
$hEventLog = _EventLog__Open("""", ""Microsoft-Windows-PrintService/Operational"")
$aEvent = _EventLog__Read($hEventLog, True, False) ; read last event
;~  $hEventLog = _EventLog__Open("""", ""System"")
;~  $aEvent = _EventLog__Read($hEventLog)
;~  $aEvent = _EventLog__Read($hEventLog, True, False)
MemoWrite(""Result ............: "" & $aEvent[ 0])
MemoWrite(""Record number .....: "" & $aEvent[ 1])
MemoWrite(""Submitted .........: "" & $aEvent[ 2] & "" "" & $aEvent[ 3])
MemoWrite(""Generated .........: "" & $aEvent[ 4] & "" "" & $aEvent[ 5])
MemoWrite(""Event ID ..........: "" & $aEvent[ 6])
MemoWrite(""Type ..............: "" & $aEvent[ 8])
MemoWrite(""Category ..........: "" & $aEvent[ 9])
MemoWrite(""Source ............: "" & $aEvent[10])
MemoWrite(""Computer ..........: "" & $aEvent[11])
MemoWrite(""Username ..........: "" & $aEvent[12])
MemoWrite(""Description .......: "" & $aEvent[13])
_EventLog__Close($hEventLog)

; Loop until user exits
Do
Until GUIGetMsg() = $GUI_EVENT_CLOSE
EndFunc   ;==>_Main
; Write a line to the memo control
Func MemoWrite($sMessage)
GUICtrlSetData($iMemo, $sMessage & @CRLF, 1)
EndFunc   ;==>MemoWrite
}}}

This problem is mentioned in some threads:
http://www.autoitscript.com/forum/topic/103883-reading-from-additional-vistawin7-event-logs/
http://www.autoitscript.com/forum/topic/135043-how-to-read-windows-7-eventlog-such-as-setup/

Please add support for this special eventlogs of windows 7/2008.


Regards
Trash

"	Feature Request	closed		Standard UDFs		None	Rejected