Allan B. Wilson; abwilson@awasu.com
Version 1.0 (first release); 11-Nov-03
No charge for personal or non-profit use. For commercial use, please e-mail the author.
Windows NT/2K/XP systems have an event-logging mechanism to capture information about Application, Security, and System events. You ordinarily use the Event Viewer (in Administrative Tools) to examine the three different logs. However, with this plug-in, Awasu can host one or more event-log information news-feed channels, retrieving and displaying information from a local or remote system’s event logs.
This is a standard Awasu channel plug-in. Install it by clicking New Channel in the File menu, then selecting the plug-in to open it. Specify the event-log details to display by supplying information in the Awasu dialogs that appear.
When you create a New Channel, the name of the plug-in to select is “awasuEventLogInfo.exe” . This file is a self-contained version of the plug-in. The plug-in was written in the Python language and uses the win32 extension modules to access event logs; however, by using the .exe file you don’t need Python or any special libraries installed on your system at all—everything the plug-in needs is in the .exe file. For this reason, it may be somewhat larger than other .exe files you are familiar with.
When you click on a link in the RSS feed, the plug-in invokes the standard Event Viewer. This allows you to easily use the standard system utility if you want full information on one or more events.
Each time the channel is refreshed, the plug-in fetches and displays the most recent ‘n’ (settable when the channel is created or modified) events from the specified event log(s). The news feed is updated to show the events, most recently received first.
You can leave the SystemName parameter blank to read the logs from the local system; otherwise put in a remote system’s simple network name.
The xxxMaxEvents parameters control how many events are displayed from each log. Zero will show zero events, but will still show how many total events are in that log; a negative number (e.g., -1) will skip that log entirely.
The xxxSourcePattern parameters allow you to confine event display to one or more particular event sources. For example, “Diskeeper” would show only events from the file defragmenting utility. Technically, these patterns are so-called regular expressions, which means they can be quite complex in specifying the sources you can match. However, it’s probably best to stick with letters and numbers; plus you can use “|” between two terms to select event sources that match either. As an example, “MKS|Diskeeper” would display events from MKS software and events from Diskeeper.
Warning: Regular expressions can make use of many special features and characters, so unless you are an RE expert or keep the patterns simple, don’t be surprised if you get strange (or no) events displayed.
Of course, by leaving a pattern empty, the plug-in will display events in the log from any source. This will probably be the most common case, though sometimes you might want to set up a channel to watch for very specific events.
The ShowEventDetails parameter is a True/False value, defaulting to True. When True, the plug-in will display a single detail line for each event after its date/time and summary. Setting it to False suppresses display of the detail line.
Should you wish to write your own event-log entries, try eventcreate.exe, which should be in the system32 subdirectory of your Windows system directory—and therefore already in your PATH. Run it with the “/?” switch to see options and examples.
This plug-in is written in Python and was developed and tested with ActivePython 2.2.2 Build 244; subsequent updates were made with Python 2.3.2 (from python.org) with the win32 extensions. The .exe file was created using Installer 5b5_5 from McMillan Enterprises, Inc.
The plug-in has been tested on Windows XP Professional, but should run on Windows 2000 and perhaps even Windows NT. Event Viewer in the links is invoked as eventvwr.exe, which should be in the standard PATH.
Though the plug-in generates utf-8 output and so can theoretically handle common natural languages, it gets most of its text from Windows, which may or may not do what you expect on non-English systems. Internally the plug-in refers explicitly to “Application“, “Security“, and “System” eventlogs; these may have localized names in other language versions of Windows and therefore the plug-in may not even retrieve information on such systems. If this happens, or there are any other unusual character-set problems, please e-mail the author.