# Win32 eventlog change\_notify and tail's not tailing in orde

**URL:** <https://www.ruby-forum.com/t/win32-eventlog-change-notify-and-tails-not-tailing-in-orde/61340>\
**Category:** Ruby\
**Created:** [May 23, 2006, 11:02am UTC](https://www.ruby-forum.com/t/win32-eventlog-change-notify-and-tails-not-tailing-in-orde/61340 "2006-05-23T11:02:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![PeSSSSaS\_Botp](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ecd19e/32.png) [@PeSSSSaS\_Botp](https://www.ruby-forum.com/u/PeSSSSaS_Botp)\
**Post date:** [May 23, 2006, 11:02am UTC](https://www.ruby-forum.com/t/win32-eventlog-change-notify-and-tails-not-tailing-in-orde/61340/1 "2006-05-23T11:02:16Z")

</div>

Hi Daniel and win32 team,

I noticed that if i run change\_notify or tail for a few records, the  
grabbed record and time is not in order.

eg,

## C:\family\ruby\win-eventlog\>test5.rb Win32::EventLog record\_number : 19558 time\_generated : Tue May 23 16:46:33 China Standard Time 2006 time\_written : Tue May 23 16:46:33 China Standard Time 2006 event\_id : 578 event\_type : audit success category : 4

## record\_number : 19226 time\_generated : Tue May 23 15:52:14 China Standard Time 2006 time\_written : Tue May 23 15:52:14 China Standard Time 2006 event\_id : 600 event\_type : audit success category : 5

## record\_number : 18903 time\_generated : Tue May 23 14:31:17 China Standard Time 2006 time\_written : Tue May 23 14:31:17 China Standard Time 2006 event\_id : 593 event\_type : audit success category : 5

## record\_number : 18603 time\_generated : Tue May 23 11:52:33 China Standard Time 2006 time\_written : Tue May 23 11:52:33 China Standard Time 2006 event\_id : 578 event\_type : audit success category : 4

## record\_number : 18296 time\_generated : Tue May 23 11:48:31 China Standard Time 2006 time\_written : Tue May 23 11:48:31 China Standard Time 2006 event\_id : 578 event\_type : audit success category : 4

* * *

## Win32::EventLog record\_number : 19575 time\_generated : Tue May 23 16:47:02 China Standard Time 2006 time\_written : Tue May 23 16:47:02 China Standard Time 2006 event\_id : 578 event\_type : audit success category : 4

note the record number and time in disorder.  
The Eventlog#read works fine though and ::read outputs the normal  
chonologic order. It’s only the change\_notify and tail where i get  
problems.

Btw, Is it possible to implem Eventlog#tail using Eventlog#read?

Thank you and kind regards -botp

---

<div class="post-metadata">

**Author:** ![PeSSSSaS\_Botp](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ecd19e/32.png) [@PeSSSSaS\_Botp](https://www.ruby-forum.com/u/PeSSSSaS_Botp)\
**Post date:** [May 23, 2006, 1:56pm UTC](https://www.ruby-forum.com/t/win32-eventlog-change-notify-and-tails-not-tailing-in-orde/61340/2 "2006-05-23T13:56:43Z")

</div>

Hi,

> * * *
> 
> event\_id : 593  
> record\_number : 18296  
> time\_written : Tue May 23 16:47:02 China Standard Time 2006  
> Btw, Is it possible to implem Eventlog#tail using Eventlog#read?
> 
> Thank you and kind regards -botp

It is a known bug.

Refer to  
[http://rubyforge.org/pipermail/win32utils-devel/2006-May/000571.html](http://rubyforge.org/pipermail/win32utils-devel/2006-May/000571.html)

I recommend you to wait the announcement of new win32-eventlog package  
before implement your own Eventlog#tail.

The pure ruby version of win32-eventlog package is about to release in  
this  
weekend.  
I guess it will provide more reliable Eventlog#tail.

Regards,

Park H.