[Win32utils-devel] Tweak to win32-eventlog

Daniel Berger djberg96 at gmail.com
Mon Dec 18 12:22:57 EST 2006

Wayne Vucenic wrote:
>> If the event log happens to have 10 or fewer event records, they will
>> fail, so I'm guessing that's what happened here.
> I thought about that, which is why I tried the two test cases which
> don't pass the 10 parameter.   And in any event (no pun intended), my
> Application event log has 2500 event records (as reported by Windows'
> Event Viewer) and my System event log has 1900 event records.


Oh, I remember now.  The offset parameter refers to a record number that 
actually exists.  The ReadEventLog function isn't smart enough to take a 
0 and understand that you mean to start at the oldest record.

With the backup log that you sent me offlist, this snippet worked fine:

flags = EventLog::SEEK_READ | EventLog::FORWARDS_READ
log = EventLog.open_backup('AppEventLogForDan.evt')
log.read(flags, log.oldest_record_number).each{ |l|
    p l

The tests you mentioned earlier fail because the oldest record number 
may not be the last record number - the numbers eventually get re-used. 
  So, the only way to make them work is to use 
EventLog#oldest_record_number as the offset.  I don't like using one 
method as part of another's test, but I see no choice here.  I'll update 
the tests.

I should have release 0.4.3 out today.



More information about the win32utils-devel mailing list