Reading windows event file like event viewer from windows/system32/config/AppEvent.evt

java-programmer, Reading windows event file like event viewer from windows/system32/config/AppEvent.evt hi ,any one can help ,me to solve my problem.
i m talking about reading AppEvent.evt SecEvent.evt SysEvent.evt files
which basically resides in C:\WINDOWS\system32\config folder of
windows xp.if we want to open that files and our computer is on n/w
than some services used all three files and i m not able to open that
files manually.if i want to read that files than i have two options
either read by event viewer or copy this file and to another place and
open it in vc++.
i have to read or parse that file by writing a pure java parser
without using any dll bcz that files runs under linux there is another
option to use so(shared object files working as a dll in linux) but i
don't want to depend on dll and so files.
one another way microsoft ;log parser but i m not sure that it
will run on linux or not ,simply i want to write independent java
program using only java based open source api
so plz give me a best approach to read or parse this event files when
they r locked by another applications or services.

this is the link which help u to understand windows event log format
and it has links of sample program written in vc++,c#,asp.net,c+
+,php .

http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html

i follow the php program approach but i got only source name,computer
name,description but not able to parse this things individually and i
also need date,event id,event type.

then i got another code from code project site,which has functionality
to read event logs it is using log4j to read this event files.and
display ti on swing interface but i want only a simple program which
did only reading or parsing event log files.

http://www.codeproject.com/csharp/tracetool.asp

java-programmer >> Reading windows event file like event viewer from windows/system32/config/AppEvent.evt hi ,any one can help ,me to solve my problem.
i m talking about reading AppEvent.evt SecEvent.evt SysEvent.evt files
which basically resides in C:\WINDOWS\system32\config folder of
windows xp.if we want to open that files and our computer is on n/w
than some services used all three files and i m not able to open that
files manually.if i want to read that files than i have two options
either read by event viewer or copy this file and to another place and
open it in vc++.
i have to read or parse that file by writing a pure java parser
without using any dll bcz that files runs under linux there is another
option to use so(shared object files working as a dll in linux) but i
don't want to depend on dll and so files.
one another way microsoft ;log parser but i m not sure that it
will run on linux or not ,simply i want to write independent java
program using only java based open source api
so plz give me a best approach to read or parse this event files when
they r locked by another applications or services.

this is the link which help u to understand windows event log format
and it has links of sample program written in vc++,c#,asp.net,c+
+,php .

http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html

i follow the php program approach but i got only source name,computer
name,description but not able to parse this things individually and i
also need date,event id,event type.

then i got another code from code project site,which has functionality
to read event logs it is using log4j to read this event files.and
display ti on swing interface but i want only a simple program which
did only reading or parsing event log files.

http://www.codeproject.com/csharp/tracetool.asp

java-programmer >> Reading windows event file like event viewer from windows/system32/config/AppEvent.evt On Wed, 18 Jul 2007 06:06:41 -0000, veeru <email***@***.com>
wrote, quoted or indirectly quoted someone who said :

>http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html

this is a binary format, presumably Little endian. You don't want a
parser. You want some custom code that reads it field by field. Java
has no built in methods to read this. The closest it has is
DataInputStream which reads big-endian binary. However, I have
written the analogous Little-endian version see
http://mindprod.com/products1.html#LEDATASTREAM

Source code is included.
--
Roedy Green Canadian Mind Products
The Java Glossary
http://mindprod.com

java-programmer >> Reading windows event file like event viewer from windows/system32/config/AppEvent.evt
veeru
> hi>
> this is the link which help u to understand windows event log format
> and it has links of sample program written in vc++,c#,asp.net,c+
> +,php .
>

Didn't help me understand Windows Event Log format. No sir.
Some quotes from the linked page.

[quote]
Now ... we'll take a look at the binary format of these logs
and attempt to break out the fields.
I have not managed to break out every field yet but in all
honesty I have not devoted more thana few evenings to the
task and I have not verified this information with external sources
(its hard to find any...).

I've found a few docs on Event Log format ...

codeproject.com
broken link

Below is what I imagined comprised an eventlog entry.
So... here is what I believe comprises a Windows Event Log in binary format:
[unquote]

java-programmer >> Reading windows event file like event viewer from windows/system32/config/AppEvent.evt veeru
>> this is the link which help u [sic] to understand windows event log format
>> and it has links of sample program written in vc++,c#,asp.net,c+
>> +,php .

Jeff Higgins wrote:
> Didn't help me understand Windows Event Log format. No sir.
> Some quotes from the linked page.
>
> [quote]
> Now ... we'll take a look at the binary format of these logs
> and attempt to break out the fields.
> I have not managed to break out every field yet but in all
> honesty I have not devoted more thana few evenings to the
> task and I have not verified this information with external sources
> (its hard to find any...).
>
> I've found a few docs on Event Log format ...
>
> codeproject.com
> broken link
>
> Below is what I imagined comprised an eventlog entry.
> So... here is what I believe comprises a Windows Event Log in binary format:
> [unquote]

I prefer the more formal usage of "comprise": "a log entry comprises the
elements ..."; I hate to see "comprise" used as if it were "constitute".

A very minor point in the context of the general lack of information you
report that this site evinces.

--
Lew

java-programmer >> Reading windows event file like event viewer from windows/system32/config/AppEvent.evt veeru wrote:
> hi ,any one can help ,me to solve my problem.

They'd be more likely to help if you avoid multi-posting, that is, posting the
same message independently to different newsgroups. Your best strategy is to
pick one.

There is a FAQ for these two newsgroups (to which I've cross-posted your
multipost) that you might choose to read. mindprod.com also has an excellent
article on newsgroup netiquette that you had best choose to read.

--
Lew

java-programmer >> Reading windows event file like event viewer from windows/system32/config/AppEvent.evt
Lew wrote:
>>
>> Below is what I imagined comprised an eventlog entry.
>> So... here is what I believe comprises a Windows Event Log in binary
>> format:
>> [unquote]
>
> I prefer the more formal usage of "comprise": "a log entry comprises the
> elements ..."; I hate to see "comprise" used as if it were "constitute".
>

I agree. Maybe someone who reads this thread of discussion and takes
a greater interest will contact the author and report our objections to him.

:-)
JH

java-programmer >> Reading windows event file like event viewer from windows/system32/config/AppEvent.evt
"Lew" <email***@***.com> wrote in message
news:email***@***.com...
> veeru
>>> this is the link which help u [sic] to understand windows event log
>>> format
>>> and it has links of sample program written in vc++,c#,asp.net,c+
>>> +,php .
>
> Jeff Higgins wrote:
>> Didn't help me understand Windows Event Log format. No sir.
>> Some quotes from the linked page.
>>
>> [quote]
>> Now ... we'll take a look at the binary format of these logs
>> and attempt to break out the fields.
>> I have not managed to break out every field yet but in all
>> honesty I have not devoted more thana few evenings to the
>> task and I have not verified this information with external sources
>> (its hard to find any...).
>>
>> I've found a few docs on Event Log format ...
>>
>> codeproject.com
>> broken link
>>
>> Below is what I imagined comprised an eventlog entry.
>> So... here is what I believe comprises a Windows Event Log in binary
>> format:
>> [unquote]
>
> I prefer the more formal usage of "comprise": "a log entry comprises the
> elements ..."; I hate to see "comprise" used as if it were "constitute".
>
> A very minor point in the context of the general lack of information you
> report that this site evinces.
>

Oops, bad citation style on my part.
My admixture of quotation and paraphrase
should probably read:

" ... we'll take a look at the binary format of these logs and attempt to
break out the fields.
I have not managed to break out every field yet but in all honesty I have
not devoted more
thana few evenings to the task and I have not verified this information with
external sources
(its hard to find any...)."

"I've found a few docs on Event Log format"

Here the author includes two links.
One of which was broken at the time I attempted to follow it.
Neither of which pointed to the "horses' mouth", which is here:
<http://msdn2.microsoft.com:80/en-us/library/bb309026.aspx>

"Below is what I imagined comprised an eventlog entry."

"So... here is what I believe comprises a Windows Event Log in binary
format:"

WAGs with little resemblance to:
<http://msdn2.microsoft.com:80/en-us/library/bb309026.aspx>