[Win32utils-devel] Tweak to win32-eventlog

Wayne Vucenic waynev at gmail.com
Sun Dec 17 00:59:42 EST 2006


> If the event log happens to have 10 or fewer event records, they will
> fail, so I'm guessing that's what happened here.

I thought about that, which is why I tried the two test cases which
don't pass the 10 parameter.   And in any event (no pun intended), my
Application event log has 2500 event records (as reported by Windows'
Event Viewer) and my System event log has 1900 event records.

> These tests pass on my system.

Which OS are you using?  They work for me on Win2K.  They fail on XP
SP2 and they fail in a different way on NT4 SP6 (but I'm assuming you
don't support NT4, which is quite reasonable)

You are quite correct that if the event log has 10 or less records,
the same tests fail as failed in my case.  But I'm pretty sure these
are two different situations that simply happen to produce the same
output.

I cleared the Application event log on my Win2K system, where these
tests used to all pass, and re-ran the tests:

C:\ruby\lib\ruby\gems\1.8\gems\win32-eventlog-0.4.2\test>ruby tc_eventlog.rb

Relax - this will take a few moments

Loaded suite tc_eventlog
Started
...................FF.....
Finished in 0.203 seconds.

  1) Failure:
test_seek_read(TC_EventLog) [tc_eventlog.rb:116]:
<11> expected but was
<0>.

  2) Failure:
test_seek_read_backwards(TC_EventLog) [tc_eventlog.rb:123]:
<10> expected but was
<0>.

26 tests, 74 assertions, 2 failures, 0 errors

But the difference is that in this case the ReadEventLog call is
setting GetLastError to 38 (end of file), which makes sense.  In the
error I'm seeing (with an application eventlog with 2500 records),
ReadEventLog sets GetLastError to 87.  To demonstrate this, I made a
change to eventlog.rb, adding one line after line 510:

            buf = 0.chr * BUFFER_SIZE
            read = [0].pack('L')
         end

         print "GetLastError returns ", GetLastError(), "\n"  # ADDED LINE

         block_given? ? nil : array
      end

Rerunning the test on Win2K (with empty Application log) with the
changed eventlog.rb:

C:\ruby\lib\ruby\gems\1.8\gems\win32-eventlog-0.4.2\test>ruby tc_eventlog.rb

Relax - this will take a few moments

Loaded suite tc_eventlog
Started
.GetLastError returns 38
GetLastError returns 38
GetLastError returns 38
GetLastError returns 38
GetLastError returns 38
..GetLastError returns 38
...........GetLastError returns 38
.GetLastError returns 38
GetLastError returns 38
GetLastError returns 38
....GetLastError returns 38
FGetLastError returns 38
F.....
Finished in 0.563 seconds.

  1) Failure:
test_seek_read(TC_EventLog) [tc_eventlog.rb:116]:
<11> expected but was
<0>.

  2) Failure:
test_seek_read_backwards(TC_EventLog) [tc_eventlog.rb:123]:
<10> expected but was
<0>.

26 tests, 74 assertions, 2 failures, 0 errors

However, when I use the same eventlog.rb on my XP system that's having
the problem:

C:\ruby\lib\ruby\gems\1.8\gems\win32-eventlog-0.4.2\test>ruby tc_eventlog.rb

Relax - this will take a few moments

Loaded suite tc_eventlog
Started
...GetLastError returns 38
................GetLastError returns 87
FGetLastError returns 87
F.....
Finished in 61.25 seconds.

  1) Failure:
test_seek_read(TC_EventLog) [tc_eventlog.rb:116]:
<11> expected but was
<0>.

  2) Failure:
test_seek_read_backwards(TC_EventLog) [tc_eventlog.rb:123]:
<10> expected but was
<0>.

26 tests, 5178 assertions, 2 failures, 0 errors

So on Win2K with an empty Application log, these two tests get 0
records because the ReadEventLog call returns "end of file", which is
correct.  On my XP system with a full Application log, these two tests
get 0 records because the ReadEventLog call returns error 87
"parameter is incorrect", which doesn't seem right.

Perhaps eventlog.rb should be changed to throw an exception if we get
any GetLastError() other than 38 (or 0) ?

This particular problem isn't getting in my way at the moment, so I'm
not suggesting that we need to figure out what's happening or do
anything about it.  But I did want to report it, just in case.

Thanks,

Wayne

On 12/16/06, Daniel Berger <djberg96 at gmail.com> wrote:
> Wayne Vucenic wrote:
> > Hi Dan,
> >
> > It was great seeing you again at RubyConf Denver!
>
> Likewise.
>
> > I gave the win32-eventlog 0.4.2 gem a try on my XP SP 2 system with
> > Ruby 1.8.5 (.NET 2.0 runtime installed), and I get two test failures:
> >
> > C:\ruby\lib\ruby\gems\1.8\gems\win32-eventlog-0.4.2\test>ruby -v
> > ruby 1.8.5 (2006-08-25) [i386-mswin32]
> >
> > C:\ruby\lib\ruby\gems\1.8\gems\win32-eventlog-0.4.2\test>ruby tc_eventlog.rb
> >
> > Relax - this will take a few moments
> >
> > Loaded suite tc_eventlog
> > Started
> > ...................FF.....
> > Finished in 57.969 seconds.
> >
> >   1) Failure:
> > test_seek_read(TC_EventLog) [tc_eventlog.rb:116]:
> > <11> expected but was
> > <0>.
> >
> >   2) Failure:
> > test_seek_read_backwards(TC_EventLog) [tc_eventlog.rb:123]:
> > <10> expected but was
> > <0>.
> >
> > 26 tests, 5180 assertions, 2 failures, 0 errors
> >
> > I tried debugging this a little. In the above 2 cases, after the
> > ReadEventLog call, GetLastError returns 87 ("The parameter is
> > incorrect").
> >
> > I played around with calls that failed and calls that succeeded, and
> > finally got these two test cases:
> >
> > This one works:
> >       flags = EventLog::SEQUENTIAL_READ | EventLog::FORWARDS_READ
> >       @records = EventLog.read(nil, nil, flags)
> >
> > And this one fails:
> >       flags = EventLog::SEEK_READ | EventLog::FORWARDS_READ
> >       @records = EventLog.read(nil, nil, flags)
> >
> > In the actual call to ReadEventLog in eventlog.rb line 460, the only
> > difference is the value of flags, which is 5 when it works, and 6 when
> > it fails.  I checked the Win32 documentation, and everything seems to
> > be fine, and it looks like both calls should succeed.
> >
> > I'm perfectly willing to help debug this, if anyone can suggest what I
> > should try next.  I guess one next step would be to try making this
> > same call from C or C++, but I didn't try that yet.
> >
> > I also tried on Win2K SP4, Ruby 1.8.2, and that works fine.
> >
> > Thanks,
> >
> > Wayne
>
> These tests pass on my system.  These tests are not especially robust.
> If the event log happens to have 10 or fewer event records, they will
> fail, so I'm guessing that's what happened here.  I suppose I should
> check the length first, or just issue a failure message that warns about
>  the possible reasons for a failure.
>
> Regards,
>
> Dan
> _______________________________________________
> win32utils-devel mailing list
> win32utils-devel at rubyforge.org
> http://rubyforge.org/mailman/listinfo/win32utils-devel
>


More information about the win32utils-devel mailing list