Beefy Boxes and Bandwidth Generously Provided by pair Networks
"be consistent"

Re^2: Win32::EventLog searching the wrong logs

by FloydATC (Deacon)
on May 02, 2014 at 08:09 UTC ( #1084746=note: print w/replies, xml ) Need Help??

in reply to Re: Win32::EventLog searching the wrong logs
in thread Win32::EventLog searching the wrong logs

I should probably have pointed out that I don't enjoy working with Windows and therefore tend to avoid it, mostly because of its tendency to do braindead stuff like what you referred to;

If you specify a custom log and it cannot be found, the event logging service opens the Application log; however, there will be no associated message or category string file.

Well, thanks! Basically, this confirms my suspicion that I'm asking for the wrong thing and Windows, instead of returning an error message like any civilized OS would, decides to "help" by giving me something completely different. (Stupid joke about toilet paper vs. sand paper goes here)

After reading the articles you linked, I ventured into the most unholy land of the Windows Registry and found the following keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Applicat +ion HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Hardware +Events HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet + Explorer HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Mana +gement Service HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows +Powershell

Uh... okay? So what about the "Setup" and "Forwarded Events" that very clearly show up in the Event Log viewer? There's something going on here that I just don't understand.

Examining the Event Log viewer closely, you may notice that those other logs have a different icon than the ones I can't read (which do not appear in the Registry). I have no idea why, but there's probably a connection.

Further, examining the "Properties" of each log, I see the following "Log paths":

%SystemRoot%\System32\Winevt\Logs\Application.evtx %SystemRoot%\System32\Winevt\Logs\Security.evtx %SystemRoot%\System32\Winevt\Logs\Setup.evtx %SystemRoot%\System32\Winevt\Logs\System.evtx %SystemRoot%\System32\Winevt\Logs\ForwardedEvents.evtx

If I try to open those files (obviously replacing "%SystemRoot%" with "C:"), Win32::EventLog->new() succeeds but ->GetNumber returns undef. Probably because they're not meant to be accessed that way.

I don't have a clue how to fix this...

-- FloydATC

Time flies when you don't know what you're doing

Replies are listed 'Best First'.
Re^3: Win32::EventLog searching the wrong logs
by Anonymous Monk on May 02, 2014 at 08:53 UTC
    Do you have a
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Applicat +ion\Setup

    Where do you find  Setup.evtx in the registry?

    Hmmm Eventlog Key (Windows)

      You probably tried those logs as administrator ... maybe you don't have permissions :/
        Viewing EVTX files in Windows XP? says XP is not compatible with the evtx files, use a machine with Vista or better to view them which probably means they're not viewable throug OpenLog and thus Win32::EventLog , so you'll probably have to use EvtQuery cause they're probably xml files

        good luck :)

        I've tried running as local "Administrator" and as a domain user who is member of "Domain Admins", which in turn is member of the local "Administrators" group.

        I wouldn't completely rule out the possibility of UAC pulling a funny trick on me, but I think the anonymous comment about Viewing EVTX files in Windows XP and EvtQuery sounds like a more promising lead.

        -- FloydATC

        Time flies when you don't know what you're doing

      No, I've searched the whole subtree for "Setup" and "Forwarded" and fould only stuff like "VSS Setup"; applications that presumably log their own internal events.

      -- FloydATC

      Time flies when you don't know what you're doing

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1084746]
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others wandering the Monastery: (2)
As of 2017-07-27 04:47 GMT
Find Nodes?
    Voting Booth?
    I came, I saw, I ...

    Results (403 votes). Check out past polls.