Eventlog Read / Write

[Citron]

Does anyone out there have any sample code on how to read and write to a Windows NT Event Log?

I think I have to use the ReadEventLog, NotifyCHangeEventLog and ReportEvent Functions but I dont have any good examples on how to use them.

[berta]

without using API U can write logevent with App object..

App.LogEvent (logBuffer, eventType)

see also the method

App.StartLogging logTarget, logMode

hi,brt


<center>
<HR width=80%>
<img src='http://web.tiscali.it/bertaplanet/images/bertaplanet.gif'>
</center>

[Citron]

That seems to work fine to write a new log ... however I am also trying to READ the current logs in the EventLogs.

[Ratava]

To Report a event you can use the windows API,

Private Declare Function dll_RegisterEventSource Lib "advapi32.dll" Alias "RegisterEventSourceA" (ByVal lpUNCServerName As String, ByVal lpSourceName As String) As Long

Private Declare Function dll_ReportEvent Lib "advapi32.dll" Alias "ReportEventA" (ByVal hEventLog As Long, ByVal wType As Integer, ByVal wCategory As Integer, ByVal dwEventID As Long, lpUserSid As Any, ByVal wNumStrings As Integer, ByVal dwDataSize As Long, lpStrings As String, lpRawData As Any) As Long

etc etc for all the other api dll calls
Public Sub ReportEvent(ByVal EventType As Integer, _
ByVal Category As Integer, _
ByVal EventID As Long, _
ByRef StringArray() As String, _
ByRef BinaryDataArray() As Byte, _
ByVal UserName As String, _
ByVal UserComputer As String, _
Optional UNCServerName As String = DefaultUNCServerName, _
Optional SourceName As String = DefaultSourceName)
On Error GoTo ErrorHandler
Dim hEventLog As Long
Dim iretv As Long
Dim iNumStrings As Integer
Dim lDataSize As Long 'SizeOfBinaryDataBuffer
Dim bUserSid() As Byte
Dim sstring As String
Dim i As Long
hEventLog = dll_RegisterEventSource(UNCServerName, SourceName)
'//wCategory [in] Specifies the event category. This is source-specific information; the category can have any value.
'//dwEventID [in] Specifies the event. The event identifier specifies the message that goes with this event as an entry in the message file associated with the event source.
'//lpUserSid [in] Pointer to the current user's security identifier. This parameter can be NULL if the security identifier is not required.
'lUserSid = 0&
LookupAccountName UNCServerName, UserName, bUserSid, vbNullString, 0
'//wNumStrings [in] Specifies the number of strings in the array pointed to by the lpStrings parameter. A value of zero indicates that no strings are present.
sstring = vbNullString
For i = 0 To (UBound(StringArray()) - 1)
sstring = sstring & StringArray(i)
Next i
'sstring = StringArray(0)
'//dwDataSize [in] Specifies the number of bytes of event-specific raw (binary) data to write to the log. If this parameter is zero, no event-specific data is present.
lDataSize = UBound(BinaryDataArray())
'//lpStrings [in] Pointer to a buffer containing an array of null-terminated strings that are merged into the message from the message file before Event Viewer displays the string to the user. This parameter must be a valid pointer (or NULL), even if wNumStrings is zero. Each string has a limit of 32K characters.
'messagearray(0) = NullTerminatedString
'//lpRawData [in] Pointer to the buffer containing the binary data. This parameter must be a valid pointer (or NULL), even if the dwDataSize parameter is zero.
iNumStrings = 1
'NullTerminatedString = StringArray(1) & vbNullChar
iretv = dll_ReportEvent(hEventLog, _
EventType, _
Category, _
EventID, _
bUserSid(0), _
iNumStrings, _
lDataSize, _
sstring, _
BinaryDataArray(0))
If iretv = 0 Then
Debug.Print "ReportEvent Failed " '& GetErrorString(Err.LastDllError)
End If
Call dll_DeregisterEventSource(hEventLog)
Exit Sub
ErrorHandler:

End Sub