reading windows event logs

Discussion in 'Python' started by EW, Nov 25, 2009.

  1. EW

    EW Guest

    Hi All,
    I'm looking for some guidance on a better way to read eventlogs
    from windows servers. I've written a handy little app that relies on
    WMI to pull the logs an in all my testing it worked great. When I
    deployed it, however, WMI choked on servers with a lot of logs. I've
    tried pulling the logs using much smaller VB scripts as well and they
    still failed, so I'm pretty sure I'm facing a WMI problem and not a
    python or system resources problem. So I couldn't effectively get
    logs off of domain controllers for example or file servers that had
    auditing turned on. Sadly those are exactly the types of servers
    whose logs are most interesting.

    So I'm looking for suggestions on a way to grab that data without
    using WMI for remote machines. I know MS has C libraries for this but
    I haven't touched C for 10 years so I'm hoping there's a python
    equivalent out there somewhere. Any advice would be appreciated.

    Thanks in advance for any help,
    Eric
    EW, Nov 25, 2009
    #1
    1. Advertising

  2. EW

    MRAB Guest

    EW wrote:
    > Hi All,
    > I'm looking for some guidance on a better way to read eventlogs
    > from windows servers. I've written a handy little app that relies on
    > WMI to pull the logs an in all my testing it worked great. When I
    > deployed it, however, WMI choked on servers with a lot of logs. I've
    > tried pulling the logs using much smaller VB scripts as well and they
    > still failed, so I'm pretty sure I'm facing a WMI problem and not a
    > python or system resources problem. So I couldn't effectively get
    > logs off of domain controllers for example or file servers that had
    > auditing turned on. Sadly those are exactly the types of servers
    > whose logs are most interesting.
    >
    > So I'm looking for suggestions on a way to grab that data without
    > using WMI for remote machines. I know MS has C libraries for this but
    > I haven't touched C for 10 years so I'm hoping there's a python
    > equivalent out there somewhere. Any advice would be appreciated.
    >

    The events logs are in %SystemRoot%\system32\config and have the
    extension .evt. There's info here on the file format:

    http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html
    MRAB, Nov 25, 2009
    #2
    1. Advertising

  3. EW

    Mark Hammond Guest

    On 26/11/2009 7:22 AM, EW wrote:
    > Hi All,
    > I'm looking for some guidance on a better way to read eventlogs
    > from windows servers. I've written a handy little app that relies on
    > WMI to pull the logs an in all my testing it worked great. When I
    > deployed it, however, WMI choked on servers with a lot of logs. I've
    > tried pulling the logs using much smaller VB scripts as well and they
    > still failed, so I'm pretty sure I'm facing a WMI problem and not a
    > python or system resources problem. So I couldn't effectively get
    > logs off of domain controllers for example or file servers that had
    > auditing turned on. Sadly those are exactly the types of servers
    > whose logs are most interesting.
    >
    > So I'm looking for suggestions on a way to grab that data without
    > using WMI for remote machines. I know MS has C libraries for this but
    > I haven't touched C for 10 years so I'm hoping there's a python
    > equivalent out there somewhere. Any advice would be appreciated.


    Look for the win32evtlog and win32evtlogutil modules which come with
    pywin32 (http://sf.net/projects/pywin32)

    Cheers,

    Mark
    Mark Hammond, Nov 25, 2009
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Gnaneshwar Babu

    extracting event logs to a file

    Gnaneshwar Babu, Dec 31, 2003, in forum: Perl
    Replies:
    0
    Views:
    709
    Gnaneshwar Babu
    Dec 31, 2003
  2. David Bear

    FAQ or HOWTO on windows event logs

    David Bear, Dec 5, 2003, in forum: Python
    Replies:
    1
    Views:
    528
    Rudy Schockaert
    Dec 6, 2003
  3. Ellinghaus, Lance
    Replies:
    1
    Views:
    510
    David Bolen
    Feb 20, 2004
  4. veeru
    Replies:
    1
    Views:
    1,527
  5. Ron

    Vista Event Logs

    Ron, Dec 12, 2008, in forum: ASP .Net
    Replies:
    0
    Views:
    456
Loading...

Share This Page