Forum Discussion

vlad230's avatar
vlad230
Contributor
13 years ago

Win 7 - Event Viewer logs

Hi guys,



I'm trying to automate a .NET application using TC8 and JScript.



The app I'm testing sends some data (XML request, response) to the windows Event Viewer and I'm trying to read those values and parse them.



Is there any way in which I could read the data posted in the Event Viewer and parse the data?



Thanks.

8 Replies

  • Hi Alexei,



    I've managed to obtain this code:





      var source = "System";

      var strComputer = ".";

     

      var objPath = "winmgmts:{impersonationLevel=impersonate}!\\\\"+strComputer+"\\root\\cimv2";

      Log.Message("Object path: "+objPath);

     

      var objWMIService = GetObject(objPath);

      var logQuery = "SELECT * FROM Win32_NTLogEvent WHERE Logfile = '"+source+"'";

      Log.Message("Log query: "+logQuery);

     

      var colLoggedEvents = objWMIService.ExecQuery(logQuery);

      Log.Message("Log: "+colLoggedEvents); //EMPTY???

      for(objEvent in colLoggedEvents){

        var out = "Category: "+objEvent.Category + " \n Computer Name: "+objEvent.ComputerName+" \n Event Code: "+objEvent.EventCode+" \n Message: "+objEvent.Message+" \n Record Number: "+objEvent.RecordNumber+" \n Source Name: "+objEvent.SourceName+" \n Time Written: "+objEvent.TimeWritten+" \n Event Type: "+objEvent.Type+" \n User: "+objEvent.User;

        Log.Message(out);

      }





    This runs but it seems that colLoggedEvents is empty and because of that it never enters the for loop.



    Any ideas what I'm doing wrong?



    Thanks.
  • AlexKaras's avatar
    AlexKaras
    Champion Level 3
    Hi Sergiu,



    I did not try JScript version of code, but VBScript one worked fine for me, so, to say the truth, I don't have good ideas at the moment. Except two ones: some issue with the 'for each' enumerator and/or insufficient permissions.
  • Hi Alexei,



    I have tried the VBScript alternative and it works fine, but I need to do it in JScript.



    It seems that my colLoggedEvents object isn't empty after all. Calling colLoggedEvents.Count returns a few thousand records.



    The problem seems to be with the for loop. It can't iterate between the elements of the object.



    I would be more interested in retrieving the Message property of the last element from the log thus not requiring the for loop.



    Can you think of a way in which I could do that?



    I've tried this:





    var lastElem = colLoggedEvents.Item(colLoggedEvents.Count-1);





    but it doesn't work.



    Thanks.
  • AlexKaras's avatar
    AlexKaras
    Champion Level 3
    Hi Sergiu,



    Far not sure whether it will work, but try this:






    var lastElem = colLoggedEvents.ItemIndex(colLoggedEvents.Count-1);



    You may try to evaluate the 'colLoggedEvents.ItemIndex(colLoggedEvents.Count-1)' expression in the debugger while script is stopped on the breakpoint to check if the returned entity is an object or scalar. In former case you may try something like



    colLoggedEvents.ItemIndex(colLoggedEvents.Count-1).value

    or

    colLoggedEvents.ItemIndex(colLoggedEvents.Count-1).OleValue
  • Hi Alexei,



    The ItemIndex() method solved my problem.



    The correct code is:





      var lastElem = colLoggedEvents.ItemIndex(0);

      Log.Message("last elem: "+lastElem.Message);





    It seems that the last log event written in the log is at index 0.



    Thanks.
  • AlexKaras's avatar
    AlexKaras
    Champion Level 3
    Hi Sergiu,




    > The ItemIndex() method solved my problem.



    Thank you for the confirmation. It looks like that ItemIndex() is standard access property for the collections returned by WMI (I suggested you to try it because I used it in my code but for different collection returned by WMI).
  • Yeah, it's strange I've browsed msdn.microsoft.com and for this type of object the only available method was Item(). Apparently they didn't bother to mention the generic ones somewhere on the site.



    Thanks a lot!