Member Avatar for nerden

In the new versions of server 2008+ MS have added an "Application and Services" folder to Event Viewer,

I dont seem to be able to programaticaly access any logs in here,

My Code:

Dim strValue As String
Dim objLogs() As EventLog
Dim Logname As String = "Microsoft-Windows-Backup"
Dim objEntry As EventLogEntry
Dim objLog As EventLog     

objLogs = EventLog.GetEventLogs()
For Each objLog In objLogs
    If objLog.LogDisplayName = Logname Then Exit For
Next
For Each entry In objLog.Entries
    msgbox(entry.message)
Next

If you set the Logname to "Application" or "System" everything works OK, but I can't access any of the new Extended logs

With regards to a solution, I dont care how i get the information out of this event log. (I thought about just opening the file "%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-Backup.evtx")

I have had the usual google but can't find anything that actually works.
(Please don't just point me to the MSDN article about access the Event log, it doesn't work for the extended logs)

Thanks in advance.

  • 3 Contributors
  • 7 Replies
  • 2K Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by nerden

Dani AI

Generated

You are bumping into the split between the old, classic logs (Application/System/Security) and the newer Windows Event Log channels under Applications and Services Logs. System.Diagnostics.EventLog only exposes the classic logs. To read channels like Windows Server Backup you need the Event Log Reader API in System.Diagnostics.Eventing.Reader. Use the full channel name (for Backup it is typically Microsoft-Windows-Backup/Operational) and, if needed, enable the channel first. You can list exact channel names with wevtutil el, and enable one with wevtutil sl "<channel>" /e:true. See Windows Event Log reference and wevtutil docs.

Quick VB.NET example that reads newest events first and renders messages:

Imports System.Diagnostics.Eventing.Reader

Sub ReadBackupLog()
    Dim channel = "Microsoft-Windows-Backup/Operational"
    Dim query = New EventLogQuery(channel, PathType.LogName, "*") With {
        .ReverseDirection = True,
        .TolerateQueryErrors = True
    }

    Using reader As New EventLogReader(query)
        Dim rec As EventRecord = reader.ReadEvent()
        While rec IsNot Nothing
            Dim msg As String = ""
            Try
                msg = rec.FormatDescription()
            Catch ex As EventLogException
                msg = rec.ToXml() 'fallback if message resources are missing
            End Try
            Console.WriteLine((If(rec.TimeCreated, DateTime.MinValue)).ToString("u") &
                              " [ID " & rec.Id & "] " & msg)
            rec.Dispose()
            rec = reader.ReadEvent()
        End While
    End Using
End Sub

Notes and tips:

  • was right to inspect names, but GetEventLogs() will not enumerate these channels; use wevtutil el instead. See Reading from the Event Log (legacy API note).
  • As mentioned, elevation matters. Alternatively, add the account to the built-in Event Log Readers group to read most channels without full admin. See Event Log Readers group.
  • If you ever need offline parsing, point EventLogQuery at a saved .evtx using PathType.FilePath.

Recommended Answers

All 7 Replies

Member Avatar for Begginnerdev

Have you tried cycling through the code in debug to see what the log names are?

Just place a break point before the loop, step into the loop (F11) then hover over the entry variable.

(You should change it to For Each e As Entry in objLog)

Edited by Begginnerdev
Member Avatar for nerden

Yea had a look at this,
when it hits objLogs = EventLog.GetEventLogs() if you break and mouse over the "GetEventLogs" bit it lists the logs:
Application
Security
Setup
System
Forwarded Events
Hardware Events
Key Managment Service
Microsoft Office Alerts
Windows PowerShell

Conviently skipping the Microsoft folder :(

I have still been tinkering with this and think it may have something to do with creating my own source. I have tried this but cant get it to make a folder under "Applications and Service logs"

Thanks for coming back to me though

Member Avatar for Begginnerdev

Just a curiosity. Is the Microsoft folder an admin only folder,and you happen to be a restricted user?

Member Avatar for nerden

Don't think so, I ran VS as administrator. If you run as normal user or local admin without "run as administrator" it won't access the event logs at all

Member Avatar for Begginnerdev

Does the local administrator have privelages over the domain, or are there two levels for admin? (Domain and local)

Edited by Begginnerdev
Member Avatar for JorgeM

If you run as normal user or local admin without "run as administrator" it won't access the event logs at all

Since Vista, regardless of the account you use to log into a computer, running programs are done using regular user priviledges. You can run programs using "run as administrator" or other situations where programs that require admin priveledges to run UAC will pop on on the screen asking for the elevation.

are there two levels for admin? (Domain and local)

Being a network administrator by trade, when I hear or see references to local admin, you are generally referring to a local administrator on a stand alone or domain joined computer. The Domain Administrator generally refers to the built-in Administrator account in an Active Directory domain. Within the domain you have the Administrators (Domain Local) group as well as the Domain Admins (Global) group.

The Domain Administrator account is a member of the Domain Admins account. Every computer that joins the domain will have a local Administrators group. Once the computer joins, the Domain Admins group becomes a member of the local Administrators groups on that computer. So when a member of the domain admins group logs into the domain on a domain joined computer, the effect is that the person is an administrator of that computer.

Back to the Vista reference, even though you log in with admin priviledges, you still run exectubles using regular user privs. You have to specifically elevate your priveldges to get access to senstive areas/services.

Member Avatar for nerden

I have managed to solve this issue by cheating a little
1) Run VS as Administrator
2) create a registry key under "HKLM\SYSTEM\CurrentControlSet\services\eventlog\" with the name of the log I wanted "Microsoft-Windows-Backup" in my case (no need for any values)
I found this little trick when looking in to WMI
3) Add a reference to my project (Project>Add reference>System.Managment)
4)Using following code to implement a WMI search:

Public Function fnGetEvents()   
        Dim objEvent As ManagementObjectSearcher
        Dim objMgmt As ManagementObject

        Dim strevtCategory As String
        Dim strevtComputerName As String
        Dim strevtEventCode As String
        Dim strevtMessage As String
        Dim strevtRecordNumber As String
        Dim strevtSourceName As String
        Dim strevtTimeWritten As String
        Dim strevtEventType As String
        Dim strevtUser As String

        objEvent = New ManagementObjectSearcher("Select * from Win32_NTLogEvent " & "Where Logfile = 'Microsoft-Windows-Backup'")

        For Each objMgmt In objEvent.Get
            strevtCategory = objMgmt("Category").ToString()
            strevtComputerName = objMgmt("ComputerName").ToString()
            strevtEventCode = objMgmt("EventCode").ToString()
            strevtMessage = objMgmt("Message").ToString()
            strevtRecordNumber = objMgmt("RecordNumber").ToString()
            strevtSourceName = objMgmt("SourceName").ToString()
            strevtTimeWritten = objMgmt("TimeWritten").ToString()
            strevtEventType = objMgmt("Type").ToString()
            strevtUser = objMgmt("User").ToString()

            Console.WriteLine("Category: " & strevtCategory & vbNewLine _
 & "Computer Name: " & strevtComputerName & vbNewLine _
 & "Event Code: " & strevtEventCode & vbNewLine _
 & "Message: " & strevtMessage & vbNewLine _
 & "Record Number: " & strevtRecordNumber & vbNewLine _
 & "Source Name: " & strevtSourceName & vbNewLine _
 & "Time Written: " & strevtTimeWritten & vbNewLine _
 & "Event Type: " & strevtEventType & vbNewLine _
 & "User: " & strevtUser)

        Next


End Function

Thanks for everyones input

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.