pbolduc has asked for the wisdom of the Perl Monks concerning the following question:

Perl module WIN32::EventLog can be used to backup and read Windows XP and Server 2003 event logs. It can also be used to backup the newer event log (.evtx) files. When I attempt to open one of the newer event logs that where backed up using the WIN32::EventLog::OpenBackup function, it fails with an Unknown error. It seems that it is attempting to use the old event viewer to access the new log formats. Can anyone provide any suggestions on how to access the new event log format? Thanks in advance....
  • Comment on How to access Windows Vista/Server 2008 eventlogs(.evtx vs. .evt)

Replies are listed 'Best First'.
Re: How to access Windows Vista/Server 2008 eventlogs(.evtx vs. .evt)
by BrowserUk (Patriarch) on Dec 10, 2009 at 19:35 UTC
    that where backed up using the WIN32::EventLog::OpenBackup function,

    I don't see and "OpenBackup" function or method in Win32::EventLog?


    Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
    "Science is about questioning the status quo. Questioning authority".
    In the absence of evidence, opinion is indistinguishable from prejudice.

        And?

        There is an internal function called OpenBackupEventLog(), which is considerably different to the OPs "WIN32::EventLog::OpenBackup function", that isn't directly exposed through the API. But rather only through the new() method, where it is invoked if the format of one of the arguments meets certain criteria.

        It is also very unclear, given the confused phraseology:

        When I attempt to open one of the newer event logs that where backed up using the WIN32::EventLog::OpenBackup function, it fails with an Unknown error.

        quite how the OP is creating the backup that he is subsequently failing to open. Does that sentence mean he was trying to use that non-existant function to perform the backup? Or the the subsequent open?

        A simple code sample shows that Win32::EventLog can backup and subsequently re-open an event log just fine under Vista:

        [0] Perl> use Win32::EventLog;; [0] Perl> print $e = Win32::EventLog->new("System", $ENV{ComputerName} +);; Win32::EventLog=HASH(0x3a70d90) [0] Perl> $e->Backup( 'c:\\test\\System.evt' );; [0] Perl> print $f = Win32::EventLog->new('c:\\test\\System.evt', $ENV +{ComputerName});; Win32::EventLog=HASH(0x3b4b500) [0] Perl>

        Note: The [0] would be non-zero if any of those calls had failed.

        OP: More information please!


        Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
        "Science is about questioning the status quo. Questioning authority".
        In the absence of evidence, opinion is indistinguishable from prejudice.