Reading windows event file like event viewer from windows/system32/config/AppEvent.evt

[veeru]

hi ,any one can help ,me to solve my problem.
i m talking about reading AppEvent.evt SecEvent.evt SysEvent.evt files
which basically resides in C:\WINDOWS\system32\config folder of
windows xp.if we want to open that files and our computer is on n/w
than some services used all three files and i m not able to open that
files manually.if i want to read that files than i have two options
either read by event viewer or copy this file and to another place and
open it in vc++.
i have to read or parse that file by writing a pure java parser
without using any dll bcz that files runs under linux there is another
option to use so(shared object files working as a dll in linux) but i
don't want to depend on dll and so files.
one another way microsoft ;log parser but i m not sure that it
will run on linux or not ,simply i want to write independent java
program using only java based open source api
so plz give me a best approach to read or parse this event files when
they r locked by another applications or services.

this is the link which help u to understand windows event log format
and it has links of sample program written in vc++,c#,asp.net,c+
+,php .

http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html

i follow the php program approach but i got only source name,computer
name,description but not able to parse this things individually and i
also need date,event id,event type.

then i got another code from code project site,which has functionality
to read event logs it is using log4j to read this event files.and
display ti on swing interface but i want only a simple program which
did only reading or parsing event log files.

http://www.codeproject.com/csharp/tracetool.asp

[Roedy Green]

Post by veeru
http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html

this is a binary format, presumably Little endian. You don't want a
parser. You want some custom code that reads it field by field. Java
has no built in methods to read this. The closest it has is
DataInputStream which reads big-endian binary. However, I have
written the analogous Little-endian version see
http://mindprod.com/products1.html#LEDATASTREAM

Source code is included.

[Jeff Higgins]

veeru

Post by veeru
hi>
this is the link which help u to understand windows event log format
and it has links of sample program written in vc++,c#,asp.net,c+
+,php .

Didn't help me understand Windows Event Log format. No sir.
Some quotes from the linked page.

[quote]
Now ... we'll take a look at the binary format of these logs
and attempt to break out the fields.
I have not managed to break out every field yet but in all
honesty I have not devoted more thana few evenings to the
task and I have not verified this information with external sources
(its hard to find any...).

I've found a few docs on Event Log format ...

codeproject.com
broken link

Below is what I imagined comprised an eventlog entry.
So... here is what I believe comprises a Windows Event Log in binary format:
[unquote]

[Lew]

veeru

Post by Jeff Higgins

this is the link which help u [sic] to understand windows event log format
and it has links of sample program written in vc++,c#,asp.net,c+
+,php .

Didn't help me understand Windows Event Log format. No sir.
Some quotes from the linked page.
[quote]
Now ... we'll take a look at the binary format of these logs
and attempt to break out the fields.
I have not managed to break out every field yet but in all
honesty I have not devoted more thana few evenings to the
task and I have not verified this information with external sources
(its hard to find any...).
I've found a few docs on Event Log format ...
codeproject.com
broken link
Below is what I imagined comprised an eventlog entry.
[unquote]

I prefer the more formal usage of "comprise": "a log entry comprises the
elements ..."; I hate to see "comprise" used as if it were "constitute".

A very minor point in the context of the general lack of information you
report that this site evinces.

[Jeff Higgins]

Post by Lew

Post by Jeff Higgins
Below is what I imagined comprised an eventlog entry.
[unquote]

I prefer the more formal usage of "comprise": "a log entry comprises the
elements ..."; I hate to see "comprise" used as if it were "constitute".

I agree. Maybe someone who reads this thread of discussion and takes
a greater interest will contact the author and report our objections to him.

:-)
JH

[Jeff Higgins]

Post by Lew
veeru

Post by Jeff Higgins

this is the link which help u [sic] to understand windows event log format
and it has links of sample program written in vc++,c#,asp.net,c+
+,php .

Didn't help me understand Windows Event Log format. No sir.
Some quotes from the linked page.
[quote]
Now ... we'll take a look at the binary format of these logs
and attempt to break out the fields.
I have not managed to break out every field yet but in all
honesty I have not devoted more thana few evenings to the
task and I have not verified this information with external sources
(its hard to find any...).
I've found a few docs on Event Log format ...
codeproject.com
broken link
Below is what I imagined comprised an eventlog entry.
[unquote]

I prefer the more formal usage of "comprise": "a log entry comprises the
elements ..."; I hate to see "comprise" used as if it were "constitute".
A very minor point in the context of the general lack of information you
report that this site evinces.

Oops, bad citation style on my part.
My admixture of quotation and paraphrase
should probably read:

" ... we'll take a look at the binary format of these logs and attempt to
break out the fields.
I have not managed to break out every field yet but in all honesty I have
not devoted more
thana few evenings to the task and I have not verified this information with
external sources
(its hard to find any...)."

"I've found a few docs on Event Log format"

Here the author includes two links.
One of which was broken at the time I attempted to follow it.
Neither of which pointed to the "horses' mouth", which is here:
<http://msdn2.microsoft.com:80/en-us/library/bb309026.aspx>

"Below is what I imagined comprised an eventlog entry."

"So... here is what I believe comprises a Windows Event Log in binary
format:"

WAGs with little resemblance to:
<http://msdn2.microsoft.com:80/en-us/library/bb309026.aspx>

[Lew]

Post by veeru
hi ,any one can help ,me to solve my problem.

They'd be more likely to help if you avoid multi-posting, that is, posting the
same message independently to different newsgroups. Your best strategy is to
pick one.

There is a FAQ for these two newsgroups (to which I've cross-posted your
multipost) that you might choose to read. mindprod.com also has an excellent
article on newsgroup netiquette that you had best choose to read.