|Welcome to the Monastery|
Re^2: Win32::EventLog searching the wrong logsby FloydATC (Chaplain)
|on May 02, 2014 at 08:09 UTC||Need Help??|
I should probably have pointed out that I don't enjoy working with Windows and therefore tend to avoid it, mostly because of its tendency to do braindead stuff like what you referred to;
If you specify a custom log and it cannot be found, the event logging service opens the Application log; however, there will be no associated message or category string file.
Well, thanks! Basically, this confirms my suspicion that I'm asking for the wrong thing and Windows, instead of returning an error message like any civilized OS would, decides to "help" by giving me something completely different. (Stupid joke about toilet paper vs. sand paper goes here)
After reading the articles you linked, I ventured into the most unholy land of the Windows Registry and found the following keys:
Uh... okay? So what about the "Setup" and "Forwarded Events" that very clearly show up in the Event Log viewer? There's something going on here that I just don't understand.
Examining the Event Log viewer closely, you may notice that those other logs have a different icon than the ones I can't read (which do not appear in the Registry). I have no idea why, but there's probably a connection.
Further, examining the "Properties" of each log, I see the following "Log paths":
If I try to open those files (obviously replacing "%SystemRoot%" with "C:"), Win32::EventLog->new() succeeds but ->GetNumber returns undef. Probably because they're not meant to be accessed that way.
I don't have a clue how to fix this...
Time flies when you don't know what you're doing