Ad:

VB.NET Discussion Thread
Unsolved
Views: 1851

Jan 19th, 2009

2008 displaying the task category vista event logs

Expand Post »

Hi all,

I am currently displaying the information stored in the security logs in event viewer in vista.

But i cannot get the category task to display like it is in vista (Special logon, logon, audit policy change)

when i use evententry.category.tostring it just displays a number.

Anyone know how to fix this

smelf1

Reputation Points: 10

Solved Threads: 0

Light Poster

Offline

44 posts
since Mar 2008

Permalink

Jan 20th, 2009

Re: 2008 displaying the task category vista event logs

Quote ...

when i use evententry.category.tostring it just displays a number.

What number do you get? If you get "0" (or "(0)") then the category is "None". Have you checked with Event Viewer app what category names you should get?

This is the "basic" code to dump event log

VB.NET Syntax (Toggle Plain Text)
Dim oEvLog As EventLog
Dim oEvEntry As EventLogEntry
 
oEvLog = New EventLog("Security")
 
For Each oEvEntry In oEvLog.Entries
   Debug.Print(oEvEntry.Category)
Next
Dim oEvLog As EventLog
Dim oEvEntry As EventLogEntry

oEvLog = New EventLog("Security")

For Each oEvEntry In oEvLog.Entries
   Debug.Print(oEvEntry.Category)
Next

and you use similar code?

Teme64

Reputation Points: 218

Solved Threads: 201

Veteran Poster

Offline

1,024 posts
since Aug 2008

Permalink

Jan 20th, 2009

Re: 2008 displaying the task category vista event logs

i get numbers instead of the text, so i will get 50399 or 104 instead of Special logon, logon, or audit policy change

smelf1

Reputation Points: 10

Solved Threads: 0

Light Poster

Offline

44 posts
since Mar 2008

Permalink

Jan 20th, 2009

Re: 2008 displaying the task category vista event logs

Here's what MSDN says about EventLogEntry.CategoryNumber

Quote ...

The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.

I checked the code in Vista. For some reason Security event categories were all dumped as CategoryNumber. I checked Application event categories and I got category numbers but also textual category names when one existed.

So, if you want to get names for the categories, instead of the category numbers, you'll have to find which is the resource file and use category number to get textual name directly from the resource file.

I'm just guessing how this should be done. There may be a much better way to do it, I just didn't figure it out.

Teme64

Reputation Points: 218

Solved Threads: 201

Veteran Poster

Offline

1,024 posts
since Aug 2008

Permalink

Jan 20th, 2009

Re: 2008 displaying the task category vista event logs

Have you tried just

EventLogEntry.Category ? (I saw you said evententry.category)

http://msdn.microsoft.com/en-us/libr...ry(VS.80).aspx

msdn says that this gets the text associated with the number, that doesn't work?

rapture

Reputation Points: 155

Solved Threads: 41

Posting Whiz in Training

Offline

294 posts
since Jul 2007

Permalink

Jan 20th, 2009

Re: 2008 displaying the task category vista event logs

Yes. That's what the code above (post #2) used. The problem is that EventLogEntry.Category returns EventLogEntry.CategoryNumber if there's no text (= localized string) associated with CategoryNumber. Not exactly a problem, it's supposed to work that way.

The problem came while dumping "Security" event log in Vista. EventLogEntry.Category always returned EventLogEntry.CategoryNumber for some reason.

Teme64

Reputation Points: 218

Solved Threads: 201

Veteran Poster

Offline

1,024 posts
since Aug 2008

Permalink

Jan 20th, 2009

Re: 2008 displaying the task category vista event logs

Sorry Teme I totally read past that, I see it now.

The problem was found by someone writing C# as well and there is a solution, so it has to translate to vb.net as well. I'm just not experienced enough to do this well.

http://www.codeguru.com/forum/archiv.../t-264190.html

the full C# code was here http://www.codeproject.com/KB/system/sysevent.aspx

it's the format message that needs to happen right?

rapture

Reputation Points: 155

Solved Threads: 41

Posting Whiz in Training

Offline

294 posts
since Jul 2007

Permalink

Jan 20th, 2009

Re: 2008 displaying the task category vista event logs

Code was for WinNT event log. I downloaded that project and it didn't work in XP. And the most important thing, category name, was missing. Maybe WinNT didn't have category names(?).

Also the OP (in that CodeGuru thread) ended to the same conclusion:

Quote ...

RookieRitwik September 23rd, 2003, 02:26 AM
I got the user name working. It uses lookupsid account. However I cant get the event category. I only get numbers.

Teme64

Reputation Points: 218

Solved Threads: 201

Veteran Poster

Offline

1,024 posts
since Aug 2008

Permalink

Jan 20th, 2009

Re: 2008 displaying the task category vista event logs

You're right, I stand corrected. It looked like they did this to add it to XP though

VB.NET Syntax (Toggle Plain Text)
' Setup the dataset
' (Don't forget to set the DataType of the "Date/Time" column)
ds = New DataSet("EventLog Entries")
ds.Tables.Add("Events")
With ds.Tables("Events")
    .Columns.Add("Type")
    .Columns.Add("Date/Time")
    .Columns("Date/Time").DataType = GetType(System.DateTime)
    .Columns.Add("Message")
    .Columns.Add("Source")
    .Columns.Add("Category")
    .Columns.Add("EventID")
End With
 
...
 
' Set the column type of the DataGridView as well!
If col.Name = "Date/Time" Then
    col.ValueType = GetType(System.DateTime)
End If
' Setup the dataset
' (Don't forget to set the DataType of the "Date/Time" column)
ds = New DataSet("EventLog Entries")
ds.Tables.Add("Events")
With ds.Tables("Events")
    .Columns.Add("Type")
    .Columns.Add("Date/Time")
    .Columns("Date/Time").DataType = GetType(System.DateTime)
    .Columns.Add("Message")
    .Columns.Add("Source")
    .Columns.Add("Category")
    .Columns.Add("EventID")
End With

...

' Set the column type of the DataGridView as well!
If col.Name = "Date/Time" Then
    col.ValueType = GetType(System.DateTime)
End If

will that work with what he wants to do? They are manually setting the header right?

rapture

Reputation Points: 155

Solved Threads: 41

Posting Whiz in Training

Offline

294 posts
since Jul 2007

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.

Previous Thread in VB.NET Forum Timeline: Crystal report in vb.net, printing problems

Next Thread in VB.NET Forum Timeline: Re: VB.net project

DaniWeb Message

Cancel Changes

User Name
Password