Search Results

Search found 152 results on 7 pages for 'eventlog'.

Page 1/7 | 1 2 3 4 5 6 7  | Next Page >

  • deleting eventlog

    - by user311130
    Hey, How can I delete a specific eventlog entry (say id 130 with source: Myprog) or delete all eventlogs from a specific source without deleting the whole eventlogs under "Application" folder? public static void deleteEvent() { string logName; if (EventLog.SourceExists(SOURCE)) { logName = EventLog.LogNameFromSourceName(SOURCE, "."); EventLog.Delete(logName); } } I tried the following code, but it deleted all the eventlogs under "Application". Cheers,

    Read the article

  • In .net what are the difference between Eventlog and ManagementObject for retriving logs from remote

    - by Mitesh Patel
    I have found out following two ways for getting Application Event log entries from remote server. 1. Using EventLog object string logType = "Application"; EventLog ev = new EventLog(logType,"rspl200"); EventLogEntryCollection evColl = ev.Entries 2. Using ManagementObjectSearcher object ConnectionOptions co = new ConnectionOptions(); co.Username = "testA"; co.Password = "testA"; ManagementScope scope = new ManagementScope(@"\" + "machineName"+ @"\root\cimv2", co); scope.Connect(); SelectQuery query = new SelectQuery(@"select * from Win32_NtLogEvent"); EnumerationOptions opt = new EnumerationOptions(); opt.BlockSize = 1000; using (ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query,opt)) { foreach (ManagementObject mo in searcher.Get()) { // write down log entries Console.Writeline(mo["EventCode"]); } } I can easily get remote eventlog using method #1 (Using EventLog object) without any security access denied exception. But using method #2 (Using ManagementObjectSearcher object) i get access denied exception. Actually I want remote event log (only application and also latest log not all application logs) to be displayed in treeview like below - ServerName - Logs + Error + Information + Warning Can anybody help me in this to find out best way from this or any other? Also the main thing is that user who reads remote logs may be in different domain than server. Thanks Mitesh Patel

    Read the article

  • Reading EventLog C# Errors

    - by Robert
    I have this code in my ASP.NET application written in C# that is trying to read the eventlog, but it returns an error. EventLog aLog = new EventLog(); aLog.Log = "Application"; aLog.MachineName = "."; // Local machine foreach (EventLogEntry entry in aLog.Entries) { if (entry.Source.Equals("tvNZB")) Label_log.Text += "<p>" + entry.Message; } One of the entries it returns is "The description for Event ID '0' in Source 'tvNZB' cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'Service started successfully.'" I only want the 'Service started successfully'. Any ideas?

    Read the article

  • Can't create a registry key under Eventlog and I am in administrators group

    - by Tony_Henrich
    I am troubleshooting an installer problem where it's giving an error writing to a registry key. So when I use the Registry Editor (regedit) to create the same key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog, I get a "Cannot create key: Error writing to the registry". Looking at the permissions, administrators have full access and I am a member of that group. I can create entries in other areas in the registry. When I try to take ownership, I see my name already listed. But then I get an error "Unable to set new owner on Eventlog. Insufficient system resources exist to complete the requested service". I tried after a new reboot. I turned off my firewall (Comodo). Why can't I create a new key when I am an admin and permissions indicate I have full control?

    Read the article

  • Piping powershell messages to Write-EventLog

    - by Richard
    I have a powershell script that runs a custom cmdlet. It is run by Task Scheduler and I want to log what it does. This is my current crude version: Add-PsSnapIn PianolaCmdlets Write-EventLog -LogName "Windows Powershell" -Source "Powershell" -Message "Starting Update-EbuNumbers" -EventId 0 Get-ClubMembers -HasTemporaryEbuNumber -show all | Update-EbuNumbers -Verbose Write-EventLog -LogName "Windows Powershell" -Source "Powershell" -Message "Finished Update-EbuNumbers" -EventId 0 What I would like to do is log the output of my custom cmdlet. Ideally I'd like to create different types of event log entries based on whether it was a warning or a verbose message. Update: I don't want to log the return value of the commandlet. The Update-EbuMembers cmdlet does not return an object. I want to log any verbose messages written by WriteVerbose and I want to log errors created by ThrowTerminatingError.

    Read the article

  • Eventlog entry for allowed connection in Windows Firewall

    - by Jaap
    I was seeing a lot of entries in the eventlog: The Windows Filtering Platform has permitted a connection. Application Information: Process ID: 4 Application Name: System Network Information: Direction: Inbound Source Address: 10.xxx.xxx.xxx Source Port: 80 Destination Address: 10.xxx.xxx.xxx Destination Port: 31773 Protocol: 6 Filter Information: Filter Run-Time ID: 67903 Layer Name: Receive/Accept Layer Run-Time ID: 44 We have a loadbalancer which checks every second to see if the application is still running (a health check). The logs contain large amounts of this kind of entries, which makes the Event Viewer slow and it's difficult to find the more interesting logs. How do I make sure these messages don't end up in the event logs?

    Read the article

  • Cannot start eventlog service

    - by ANervousTwitch
    On a windows 2k8R2 DC box the eventlog service wont start. When i try to start the service the machine returns: "Windows could not start the Windows Event Log service on Local Computer. Error 13: The data is invalid." event viewer wont open either. obviously, i dont have an event log for this error. ive already tried clearing the event logs. that didnt do anything. the other DC isnt experiencing this issue.

    Read the article

  • get-eventlog issue

    - by Jim B
    I wanted to get a quick report of some log entries I saw on a server, so I ran: Get-Eventlog -logname system -newest 10 -computer fs1 | fl I got events back however the descriptions were all wrong. Here's an example: Index : 1260055 EntryType : Warning InstanceId : 2186936367 Message : The description for Event ID '-2108030929' in Source 'W32Time' cannot be found. The local compute r may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'time. windows.com,0x1' Category : (0) CategoryNumber : 0 ReplacementStrings : {time.windows.com,0x1} Source : W32Time TimeGenerated : 1/25/2010 10:43:31 AM TimeWritten : 1/25/2010 10:43:31 AM UserName : Note that if I pull the event ID property it's correct (in this case 38) Is this is known issue or is something wrong. The messages resolve fine via event viewer locally and remotely Here is the powershell version info: Name : ConsoleHost Version : 2.0 InstanceId : bc58fcf8-bba3-4ca8-8972-17dbd5d9ff08 UI : System.Management.Automation.Internal.Host.InternalHostUserInterface CurrentCulture : en-US CurrentUICulture : en-US PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy IsRunspacePushed : False Runspace : System.Management.Automation.Runspaces.LocalRunspace Here is the revised version info: Name Value ---- ----- CLRVersion 2.0.50727.3603 BuildVersion 6.0.6002.18111 PSVersion 2.0 WSManStackVersion 2.0 PSCompatibleVersions {1.0, 2.0} SerializationVersion 1.1.0.1 PSRemotingProtocolVersion 2.1

    Read the article

  • get-eventlog issue

    - by Jim B
    I wanted to get a quick report of some log entries I saw on a server, so I ran: Get-Eventlog -logname system -newest 10 -computer fs1 | fl I got events back however the descriptions were all wrong. Here's an example: Index : 1260055 EntryType : Warning InstanceId : 2186936367 Message : The description for Event ID '-2108030929' in Source 'W32Time' cannot be found. The local compute r may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'time. windows.com,0x1' Category : (0) CategoryNumber : 0 ReplacementStrings : {time.windows.com,0x1} Source : W32Time TimeGenerated : 1/25/2010 10:43:31 AM TimeWritten : 1/25/2010 10:43:31 AM UserName : Note that if I pull the event ID property it's correct (in this case 38) Is this is known issue or is something wrong. The messages resolve fine via event viewer locally and remotely Here is the powershell version info: Name : ConsoleHost Version : 2.0 InstanceId : bc58fcf8-bba3-4ca8-8972-17dbd5d9ff08 UI : System.Management.Automation.Internal.Host.InternalHostUserInterface CurrentCulture : en-US CurrentUICulture : en-US PrivateData : Microsoft.PowerShell.ConsoleHost+ConsoleColorProxy IsRunspacePushed : False Runspace : System.Management.Automation.Runspaces.LocalRunspace Here is the revised version info: Name Value ---- ----- CLRVersion 2.0.50727.3603 BuildVersion 6.0.6002.18111 PSVersion 2.0 WSManStackVersion 2.0 PSCompatibleVersions {1.0, 2.0} SerializationVersion 1.1.0.1 PSRemotingProtocolVersion 2.1

    Read the article

  • Windows 7 - Move location of Eventlog

    - by Jörg B.
    I am having a particular nasty problem of my main system drive 'disappearing' all of the sudden while the system is running. The vendor somewhat knows about this but has not managed to fix it completely over multiple fw iterations. Problems I have with the support is that I cannot provide any particular system log files/entries to further analyse what might have been going on because, well - windows cannot write to its 'lost' drive before bsod'ing. Is there any way to configure where Windows 7 stores its event logs so that I could specify a second physical hdd?

    Read the article

  • IIS EventLog Errors

    - by chris
    I keep getting this error in my event viewer on IIS 6. I'm trying to figure out if my error resets my connection (maybe recycles the worker processes?). The error is: An attempt was made to load filter 'C:\Program Files\Software Artisans\FileUp \FileUpIsapi.dll' but it requires the SF_NOTIFY_READ_RAW_DATA filter notification and this notification is not supported in Worker Process Isolation Mode. For more information, see Help and Support Center at http://go.microsoft.com/fwlink /events.asp.

    Read the article

  • When writing to the Windows Event Log, is it possible to create a custom link text for URLs?

    - by thomasnguyencom
    I'm just using the vanilla EventLog.WriteEntry method: EventLog.WriteEntry(EVENT_SOURCE, message, EventLogEntryType.Error, id); Here's how the message shows up in the Event Log, with the links in the parenthesis working just fine, but it's ugly: Example 1: Please contact us via email (mailto:[email protected]) or online (http://example.com). Here's how the message shows up in the Event Log, with the HTML "markup", doesn't even handle it: Example 2: Please contact us via <a href="mailto:[email protected]">email</a> or <a href="http://example.com">online</a>. This is how I would like the message to show up, but with "email" and "online" as the link texts: Example 3: Please contact us via email or online. I've tried the <a href>...</a> HTML tags with no success.

    Read the article

  • Why Does My Vector<PEVENTLOGRECORD> Mysteriously Get Cleared?

    - by Eric
    Hello everyone, I am making a program that reads and stores data from Windows EventLog files (.evt) in C++. I am using the calls OpenBackupEventLog(ServerName, FileName) and ReadEventLog(...). Also using this: PEVENTLOGRECORD Anyway, without supplying all of the code, here is the basic idea: 1. I get a handle to the .evt file using OpenBackupEventLog() and passing in a file name. 2. I then use ReadEventLog() to fill up a buffer with an unknown number of EventLog messages. 3. I traverse through the buffer and add each message to a vector 4. I keep filling up buffers (repeat steps 2 and 3) until I reach the end of the file. Here is my code for filling the vector: vector<PEVENTLOGRECORD> allRecords; while(_status == ERROR_SUCCESS) { if(!ReadEventLog(...)) CheckStatus(); else FillVectorFromBuffer(allRecords) } // Function FillVectorFromBuffer FillVectorFromBuffer(vector(PEVENTLOGRECORD) &allRecords) { int bytesExamined = 0; PBYTE pRecord = (PBYTE)_lpBuffer; // This is one of the params in ReadEventLog() while(bytesExamined < _pnBytesRead) // Another param from ReadEventLog { PEVENTLOGRECORD currentRecord = (PEVENTLOGRECORD)(pRecord); allRecords.push_back(currentRecord); pRecord += currentRecord->Length; bytesExamined += currentRecord->Length; } } Anyway, whenever I run this, it will get all the EventLogs in the file, and the vector will have everything I want it to. But as soon as this line: if(!ReadEventLog()) gets called and returns true (aka ReadEventLog() returns false), then every field in my vector gets set to zero. The vector will still contain the correct number of elements, it's just that all of the fields in the PEVENTLOGRECORD struct are now zero. Anyone with better debugging experience have any ideas? Thanks.

    Read the article

  • How to open saved event log archive in .NET?

    - by cybri200
    I have used the System.Diagnostics.EventLog to view the logs on the local computer. However, I would like to open a saved event log archive (.evt or .evtx) and view the logs that are contained in the saved file. I just need to view timestamps, messages, sources, etc. associated with the logs in the file. Can this be done in C#?

    Read the article

  • Access to Windows 7 log from a remote machine

    - by robob
    I'm trying to access with EventViewer (from a Windows XP Prof) to a remote machine with Windows 7 (Seven). Before I started the Service "RemoteRegistry" I received an "Access Denied". After started the service I can connet to the machine Log (in EventViewer app) but when i clik on any log as "Application" or "Security" I receive a "privilege" error. Could someone help me, please?

    Read the article

  • Eventlogtracelistener not working on windows server 2008?

    - by djerry
    Hey guys, I'm trying to debug a service to tries to start but is immediatly stopped. I'm integrating an eventlogtracelistener, and tested it on my pc. When i start the service, i get 5 logs in my eventviewer. One is even the first thing it calls. When i install my service on the server, and try to start it, i don't get even 1 log in evenlogs and as i said before, i starts, takes 1 second and then stops automatically. Doesn't my service has the rights to write to eventlog? Thanks in advance.

    Read the article

  • How to get new logs in an EventLogEntyCollection?

    - by Massimo
    I need to monitor security event logs on very busy domain controllers, which generates hundreds of them each minute. I know how to use EventLog, EventLogEntry and EvenLogEntryCollection to open and read a server's event log, but an EvenLogEntryCollection can contain ~300.000 events, and it wraps around continuously (and very fast), so I can't rely on its index to find new entries. So far, the only thing I was able to come up with is saving the timestamp of the last processed log entry and then iterate above the EventLogEntryCollection until I find an EventLogEntry which TimeGenerated properties is greater than the timestamp I saved; but it's terribly slow to iterate on ~300.000 entries to find the new ones. How can I quickly find the new entries in an big event log?

    Read the article

  • Application error: fault address 0x00012afb (Expert)

    - by Christian Almeida
    Hi, I need some "light" to get a solution. Probably there are tons of things that cause this problem, but maybe somebody could help me. Scenario: a Windows server running 24/7 a PostgreSQL database and others server applications (for processing tasks on database, etc...). There are differents servers scenarios (~30), with different hardware and windows versions (XP SP3/ WinServer, etc... all NT based). All aplications were written in Delphi7, and link to DLLs (in D7 also). After some days (sometimes a week, sometimes a couple of months), Windows begins to act strange, like not opening start menu, some buttons are missing in dialogs. And soon some applications do not open, raising a event on eventviewer: Faulting application x, version y, faulting module kernel32.dll, version 5.1.2600.5781, fault address 0x00012afb In mean while, others applications open fine, like notepad, iexplore, etc... but SOME of my applications don't, with only event log described above. But if we do not restart system, in a few days even cmd.exe stops open, (and all other applications) with same error on eventlog. I've tried to find 'what' can cause this, but with no sucess. So, and any advice will be welcome. Thanks in advance.

    Read the article

  • Iterating through Event Log Entry Collection, IndexOutOutOfBoundsException

    - by fjdumont
    Hello, in a service application I am iterating through the Windows application event log to parse Events in order react depanding on the entry message. In the case that the event log is full (Windows usually makes sure there is enough space by deleting old entries - this is configurable in the eventvwr.exe settings), the service always runs into an IndexOutOfBoundsException while iterating through the EventLog.Entries collection. No matter how I iterate (for-loop, using the collections enumerator, copying the collection into an array, ...), I can't seem to get rid of this ´bug´. Currently, I ensure that the log is not full in order to keep the service running by regularly deleting the last few item by parsing the event log file and deleting the last few nodes (Don't beat me up, I couldn't find a better alternative...). How can I iterate through the collection without trying to access already deleted entries? Is there probably a more elegant method? I am only trying to acces the logs written during the last x seconds (even LINQ failed to select those when the log is full - same exception), could this help? Thanks for any advice and hints Frank Edit: I forgot to mention that my assumption is the loops are accessing entries which are being deleted during iteration by Windows. Basically that is why I tried to clone the collection. Is there perhaps a way to lock the collection for a small amount of time for just my application?

    Read the article

  • logparser not matching on a LIKE pattern

    - by user79339
    Hi I seem to have the strangest problem. I am using logparser to search an event log for some text that I know is there (i copied and pasted the string from the event into the sql search string). But the sql LIKE statement is returning a empty results. But other LIKE statments seem to be working file. I have even tried using two '%' symbols in case the shell was trying to replace the search pattern with an environment variable '%%NavigationOccuredEventHandler%%', escaping the % with a \ and with a ' but all these just give me "No valid LIKE mask" error My logparser command - C:\Program Files\Log Parser 2.2LogParser.exe "select * from D:\Temp\07i132ppa1_app.evt where Message like '%NavigationOccuredEventHandler%' " -i:EVT -o:Datagrid The Entry in event log (found using "Select * from D:\Temp\07i132ppa1_app.evt" and doing a copy paste of relevant row) - 'D:\Temp\07i132ppa1_app.evt 5976788 2010-03-09 11:53:23 2010-03-09 11:53:23 2 1 Error event 0 None ICP Timestamp: 9/03/2010 1:53:23 AM Message: Error # 068464030040-07I132PPA1 System.Web.HttpUnhandledException: Exception of type 'System.Web.HttpUnhandledException' was thrown. ---> System.NullReferenceException: Object reference not set to an instance of an object. at ClientRegistration.Controller.ContactDetailsController.NavigationOccuredEventHandler(Object sender, NavigateEventArgs e) at Microsoft.ApplicationBlocks.UIProcess.UIPManager.NavigateEventHandler.Invoke(Object sender, NavigateEventArgs e) at Microsoft.ApplicationBlocks.UIProcess.UIPManager.InvokeEventHandlers(State state) in . . . Truncated for brevity ' output Statistics: Elements processed: 240993 Elements output: 0 Execution time: 59.47 seconds But if i searched for the pattern '%object reference not set%' it works fine, returns results. I copied and pasted the string into a dummy sql table and ran the sql query there and it works fine. Just doesn't seem to work in logparser. Very baffling. Any help would be much appreciated

    Read the article

  • Modify the Event Log Source name for an SSIS package

    - by Paul Kohler
    I have an SSIS package that logs to the Event Log (yes, the event log!) The default "Source" of the log events is "SQLISPackage100" but I want it to be something like "AppName". Event Type: Error Event Source: SQLISPackage100 Event Category: None ... Description: Package "Foo" failed. I hope the answer is simple, but does anyone know how to change the text of the Event Log Source?

    Read the article

  • Modify the Event Log Source name for an SSIS package

    - by Paul Kohler
    I have an SQL Server integration Services (SSIS) package using the standard Event Log provider (yes, the event log! I know we can use SQL etc...) The default "Source" of the log events is "SQLISPackage100" but I want it to be something like "AppName" so that the errors are more visible between the different packages when viewing the event log (also for MOM use). Event Type: Error Event Source: SQLISPackage100 Event Category: None ... Description: Package "Foo" failed. I hope the answer is simple, I simply cannot find it, but does anyone know how to change the text of the Event Log Source name to something more meaningful? PK :-)

    Read the article

  • I would like to prevent these entries from being added to the eventlog.

    - by David Smith
    Our client's application EventLog is getting filled up with warnings due to a bug in the Microsoft SQL Server report viewer control, http://support.microsoft.com/kb/973219. They have thousands of users running reports so this is making their eventlog hard to use and they want them removed on a frequent basis. I tried using PowerShell to remove the events, but that does not seem possible. Is there a way to prevent these entries from being written to the event log in the first place? I'm thinking I would like to filter out events where event source="ASP.NET 2.0.50727.0", eventId ="1309" and Message contains "Reserved.ReportViewerWebControl.axd"

    Read the article

  • Access to Windows 7 log from a remote machine [closed]

    - by robob
    I'm trying to access with EventViewer (from a Windows XP Prof) to a remote machine with Windows 7 (Seven). Before I started the Service "RemoteRegistry" I received an "Access Denied". After started the service I can connet to the machine Log (in EventViewer app) but when i clik on any log as "Application" or "Security" I receive a "privilege" error. Could someone help me, please?

    Read the article

  • What's the primary use of Windows Event Viewer?

    - by james.ingham
    Hi all, Just wondering what everybody's opinion is on the Windows Admin tool Event Viewer? I'm writing a WCF application at the moment and have started logging errors to the windows event viewer when I handle them. I then started thinking, should I be logging more than just errors, such as when a user has logged in or out or would you go further logging even more activity? Or is this a tool that's mainly used for testing without using the debugger? Any input appreciated:-)

    Read the article

1 2 3 4 5 6 7  | Next Page >