Win32-EventLog problem

J

Joey Gibson

I installed the latest Win32-EventLog the other day and can query my
EventLog fine, but there are cases where I can see a description in the
EventViewer, but my Ruby code gets a nil for description. I first
noticed this while trying to pull out all the failed ssh logins that
were reported (I've been under siege the last week or so from the ssh
exploit script). I was able to get at those records that were from sshd,
all of which had text like this shown in the EventViewer:

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found.
The local computer may not have the necessary registry information or
message DLL files to display messages from a remote computer. You may be
able to use the /AUXSOURCE= flag to retrieve this description; see Help
and Support for details. The following information is part of the event:
invalid login.

But Ruby shows me nil for the description. I've also seen this with
other processes. The pattern seems to be that if the Event Id is 0, a
message like that shows up, with the last sentence saying "in part of
the event" and them some info that is actually useful. But with Ruby,
all I get is nil for the description. I've briefly looked at the C
source for this, but I'm not familiar with the EventLog code in Windows...

So, is there anything that I can do to get the description that the
EventViewer displays instead of nil, in those cases where the Event Id
is 0 (or the event can't be found, or whatever the problem is)? It seems
like the EventViewer has access to something that we don't.

BTW, this is on a WindowsXP Pro sp1 system. (Actually two different
systems.)

Joey

--
She drove a Plymouth Satellite
Faster than the Speed of Light...

http://www.joeygibson.com/blog
http://www.joeygibson.com/blog/life/Wisdom.html
Atlanta Ruby User Group http://www.AtlRUG.org
 
D

Daniel Berger

Joey Gibson said:
I installed the latest Win32-EventLog the other day and can query my
EventLog fine, but there are cases where I can see a description in the
EventViewer, but my Ruby code gets a nil for description. I first
noticed this while trying to pull out all the failed ssh logins that
were reported (I've been under siege the last week or so from the ssh
exploit script). I was able to get at those records that were from sshd,
all of which had text like this shown in the EventViewer:

<snip>

This bug has been identified and fixed in CVS. I'll post a new
release tonight. For more information, please see the
win32utils-devel mailing list archive.

Regards,

Dan
 
J

Joey Gibson

Daniel said:
This bug has been identified and fixed in CVS. I'll post a new

release tonight. For more information, please see the
win32utils-devel mailing list archive.

Excellent! I just pulled the files from CVS, built and tested. I'm
seeing stuff now that I didn't see before. This is exactly what I
wanted. Thanks, Daniel.

Joey

--
She drove a Plymouth Satellite
Faster than the Speed of Light...

http://www.joeygibson.com/blog
http://www.joeygibson.com/blog/life/Wisdom.html
Atlanta Ruby User Group http://www.AtlRUG.org
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Members online

Forum statistics

Threads
473,744
Messages
2,569,484
Members
44,906
Latest member
SkinfixSkintag

Latest Threads

Top