in reply to Re^2: How to access Windows Vista/Server 2008 eventlogs(.evtx vs. .evt)
in thread How to access Windows Vista/Server 2008 eventlogs(.evtx vs. .evt)
And?
There is an internal function called OpenBackupEventLog(), which is considerably different to the OPs "WIN32::EventLog::OpenBackup function", that isn't directly exposed through the API. But rather only through the new() method, where it is invoked if the format of one of the arguments meets certain criteria.
It is also very unclear, given the confused phraseology:
When I attempt to open one of the newer event logs that where backed up using the WIN32::EventLog::OpenBackup function, it fails with an Unknown error.
quite how the OP is creating the backup that he is subsequently failing to open. Does that sentence mean he was trying to use that non-existant function to perform the backup? Or the the subsequent open?
A simple code sample shows that Win32::EventLog can backup and subsequently re-open an event log just fine under Vista:
[0] Perl> use Win32::EventLog;; [0] Perl> print $e = Win32::EventLog->new("System", $ENV{ComputerName} +);; Win32::EventLog=HASH(0x3a70d90) [0] Perl> $e->Backup( 'c:\\test\\System.evt' );; [0] Perl> print $f = Win32::EventLog->new('c:\\test\\System.evt', $ENV +{ComputerName});; Win32::EventLog=HASH(0x3b4b500) [0] Perl>
Note: The [0] would be non-zero if any of those calls had failed.
OP: More information please!
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re^4: How to access Windows Vista/Server 2008 eventlogs(.evtx vs. .evt)
by Anonymous Monk on Jun 11, 2010 at 14:35 UTC | |
by BrowserUk (Patriarch) on Jun 11, 2010 at 15:03 UTC |