Hi all,

I am currently displaying the information stored in the security logs in event viewer in vista.

But i cannot get the category task to display like it is in vista (Special logon, logon, audit policy change)

when i use evententry.category.tostring it just displays a number.

Anyone know how to fix this

when i use evententry.category.tostring it just displays a number.

What number do you get? If you get "0" (or "(0)") then the category is "None". Have you checked with Event Viewer app what category names you should get?

This is the "basic" code to dump event log

Dim oEvLog As EventLog
Dim oEvEntry As EventLogEntry

oEvLog = New EventLog("Security")

For Each oEvEntry In oEvLog.Entries
   Debug.Print(oEvEntry.Category)
Next

and you use similar code?

i get numbers instead of the text, so i will get 50399 or 104 instead of Special logon, logon, or audit policy change

Here's what MSDN says about EventLogEntry.CategoryNumber

The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.

I checked the code in Vista. For some reason Security event categories were all dumped as CategoryNumber. I checked Application event categories and I got category numbers but also textual category names when one existed.

So, if you want to get names for the categories, instead of the category numbers, you'll have to find which is the resource file and use category number to get textual name directly from the resource file.

I'm just guessing how this should be done. There may be a much better way to do it, I just didn't figure it out.

Yes. That's what the code above (post #2) used. The problem is that EventLogEntry.Category returns EventLogEntry.CategoryNumber if there's no text (= localized string) associated with CategoryNumber. Not exactly a problem, it's supposed to work that way.

The problem came while dumping "Security" event log in Vista. EventLogEntry.Category always returned EventLogEntry.CategoryNumber for some reason.

Code was for WinNT event log. I downloaded that project and it didn't work in XP. And the most important thing, category name, was missing. Maybe WinNT didn't have category names(?).

Also the OP (in that CodeGuru thread) ended to the same conclusion:

RookieRitwik September 23rd, 2003, 02:26 AM
I got the user name working. It uses lookupsid account. However I cant get the event category. I only get numbers.

You're right, I stand corrected. It looked like they did this to add it to XP though

' Setup the dataset
' (Don't forget to set the DataType of the "Date/Time" column)
ds = New DataSet("EventLog Entries")
ds.Tables.Add("Events")
With ds.Tables("Events")
    .Columns.Add("Type")
    .Columns.Add("Date/Time")
    .Columns("Date/Time").DataType = GetType(System.DateTime)
    .Columns.Add("Message")
    .Columns.Add("Source")
    .Columns.Add("Category")
    .Columns.Add("EventID")
End With

...

' Set the column type of the DataGridView as well!
If col.Name = "Date/Time" Then
    col.ValueType = GetType(System.DateTime)
End If

will that work with what he wants to do? They are manually setting the header right?

This article has been dead for over six months. Start a new discussion instead.