# Windows Event Logging

**URL:** <https://www.ruby-forum.com/t/windows-event-logging/120124>\
**Category:** Ruby\
**Created:** [November 13, 2007, 11:05pm UTC](https://www.ruby-forum.com/t/windows-event-logging/120124 "2007-11-13T23:05:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [November 13, 2007, 11:05pm UTC](https://www.ruby-forum.com/t/windows-event-logging/120124/1 "2007-11-13T23:05:59Z")

</div>

Hello,

Anyone know a way to read Window eventlogs remotely and add them to a  
mysql database for a webpage to create reports from?

I have looked at Win32-event & win32-eventlog and with no luck so far.

---

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [November 13, 2007, 11:35pm UTC](https://www.ruby-forum.com/t/windows-event-logging/120124/2 "2007-11-13T23:35:50Z")

</div>

Le 13 novembre 2007 à 23:04, Brian S. a écrit :

> I have looked at Win32-event & win32-eventlog and with no luck so far.

Microsoft gives away a tool called logparser [1], which exports an  
eventlog to CSV or XML. From there, you can slurp the file and analyze  
it with ruby.

Of course, you need to run it from a windows box (or maybe with another  
OS, wine, and a good dose of luck).

Fred  
[1] :  
[http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx](http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx)

---

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [November 13, 2007, 11:37pm UTC](https://www.ruby-forum.com/t/windows-event-logging/120124/3 "2007-11-13T23:37:36Z")

</div>

On Nov 13, 2007 3:04 PM, Brian S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hello,
> 
> Anyone know a way to read Window eventlogs remotely and add them to a  
> mysql database for a webpage to create reports from?
> 
> I have looked at Win32-event & win32-eventlog and with no luck so far.

You should be able to do it with WMI. Without doing some research I’m  
not sure exactly how though.

The following code runs without error but I have no idea what the  
structure of the returned object is so have no way of knowing how to  
drill into it for useful data:

wmi = WIN32OLE.connect(“winmgmts:\\” + machinename + “\root\cimv2”)  
wmi.ExecQuery(“Select \* from Win32\_NTLogEvent Where Logfile =  
‘Application’”)

To be honest I’m not sure this is working properly, WMI can be pretty  
crappy about feedback, from my experience. The last time I used this,  
I was creating home directories on remote machines when people  
requested accounts, I had to do a lot of trial and error. I’m not a  
Windows guy either though.

–  
“Hey brother Christian with your high and mighty errand, Your actions  
speak so loud, I can’t hear a word you’re saying.”

-Greg Graffin (Bad Religion)

---

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [November 13, 2007, 11:51pm UTC](https://www.ruby-forum.com/t/windows-event-logging/120124/4 "2007-11-13T23:51:08Z")

</div>

On Nov 13, 3:04 pm, Brian S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hello,
> 
> Anyone know a way to read Window eventlogs remotely and add them to a  
> mysql database for a webpage to create reports from?
> 
> I have looked at Win32-event & win32-eventlog and with no luck so far.

You want win32-eventlog. As per the docs, you specify the remote host  
name as the second argument to EventLog.new:

require ‘win32/eventlog’  
include Win32

# Replace ‘Application’ with whatever event source you want

EventLog.new(‘Application’, some\_host) do |log|  
p log  
end

Putting the event log descriptions into a MySQL database is something  
you’ll have to do on your own.

Regards,

Dan

---

<div class="post-metadata">

**Author:** ![brianspaid](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/82dd89/32.png) [@brianspaid](https://www.ruby-forum.com/u/brianspaid)\
**Post date:** [November 15, 2007, 2:11pm UTC](https://www.ruby-forum.com/t/windows-event-logging/120124/5 "2007-11-15T14:11:15Z")

</div>

From: Brian S. [[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)]

# Anyone know a way to read Window eventlogs remotely and add

# them to a

# mysql database for a webpage to create reports from?

# 

# I have looked at Win32-event & win32-eventlog and with no luck so far.

what is wrong w win32-eventlog?  
you can even do realtime monitor w it using eventlog#tail or  
evenlog#change\_notify…

kind regards -botp