2008 displaying the task category vista event logs

[smelf1]

Hi all,

I am currently displaying the information stored in the security logs in event viewer in vista.

But i cannot get the category task to display like it is in vista (Special logon, logon, audit policy change)

when i use evententry.category.tostring it just displays a number.

Anyone know how to fix this

[Teme64]

when i use evententry.category.tostring it just displays a number.

What number do you get? If you get "0" (or "(0)") then the category is "None". Have you checked with Event Viewer app what category names you should get?

This is the "basic" code to dump event log

Dim oEvLog As EventLog
Dim oEvEntry As EventLogEntry

oEvLog = New EventLog("Security")

For Each oEvEntry In oEvLog.Entries
   Debug.Print(oEvEntry.Category)
Next

and you use similar code?

[smelf1]

i get numbers instead of the text, so i will get 50399 or 104 instead of Special logon, logon, or audit policy change

[Teme64]

Here's what MSDN says about EventLogEntry.CategoryNumber

The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.

I checked the code in Vista. For some reason Security event categories were all dumped as CategoryNumber. I checked Application event categories and I got category numbers but also textual category names when one existed.

So, if you want to get names for the categories, instead of the category numbers, you'll have to find which is the resource file and use category number to get textual name directly from the resource file.

I'm just guessing how this should be done. There may be a much better way to do it, I just didn't figure it out.

[rapture]

Have you tried just

EventLogEntry.Category ? (I saw you said evententry.category)

http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.category(VS.80).aspx

msdn says that this gets the text associated with the number, that doesn't work?

[Teme64]

Yes. That's what the code above (post #2) used. The problem is that EventLogEntry.Category returns EventLogEntry.CategoryNumber if there's no text (= localized string) associated with CategoryNumber. Not exactly a problem, it's supposed to work that way.

The problem came while dumping "Security" event log in Vista. EventLogEntry.Category always returned EventLogEntry.CategoryNumber for some reason.

[rapture]

Sorry Teme I totally read past that, I see it now.

The problem was found by someone writing C# as well and there is a solution, so it has to translate to vb.net as well. I'm just not experienced enough to do this well.

http://www.codeguru.com/forum/archive/index.php/t-264190.html

the full C# code was here http://www.codeproject.com/KB/system/sysevent.aspx

it's the format message that needs to happen right?

[Teme64]

Code was for WinNT event log. I downloaded that project and it didn't work in XP. And the most important thing, category name, was missing. Maybe WinNT didn't have category names(?).

Also the OP (in that CodeGuru thread) ended to the same conclusion:

RookieRitwik September 23rd, 2003, 02:26 AM
I got the user name working. It uses lookupsid account. However I cant get the event category. I only get numbers.

[rapture]

You're right, I stand corrected. It looked like they did this to add it to XP though

' Setup the dataset
' (Don't forget to set the DataType of the "Date/Time" column)
ds = New DataSet("EventLog Entries")
ds.Tables.Add("Events")
With ds.Tables("Events")
    .Columns.Add("Type")
    .Columns.Add("Date/Time")
    .Columns("Date/Time").DataType = GetType(System.DateTime)
    .Columns.Add("Message")
    .Columns.Add("Source")
    .Columns.Add("Category")
    .Columns.Add("EventID")
End With

...

' Set the column type of the DataGridView as well!
If col.Name = "Date/Time" Then
    col.ValueType = GetType(System.DateTime)
End If

will that work with what he wants to do? They are manually setting the header right?