Event Log Details Help :(

[wsmierciak]

I am working on a Windows Server 2003, and while using VB trying to get my code to pull certain data out of the Event Log (security log specifically) to sort them by Login Name and Logon ID (this is a GUID, not a name).

I have found that if I write the evt.message, it has the data within that, that I need. However, I don't want ALL of that data.
Is it possible to extract certain fields that are in the message, without having to write the file twice. (once to write it all, and once to extract it).

The code that I have now is:

For Each Evt In log.Entries
If Evt.Source = "Security" Then
If Evt.EventID = 538 Or Evt.EventID = 551 Then
sw.WriteLine((Evt.UserName & ", " & Evt.EventID & ", " & Evt.TimeGenerated))
End If


This writes to a text file, and is saved, yet I need to just extract this info and the Logon ID: information from the evt.message area.

Any help would be appreciated!
William

 

[TechGnome]

Stuff it into a string variable (instead of the file) and prse that... then write those results into the file.

-tgq

 

[wsmierciak]

Will it handle that? I'm writing the entire Security Event Log, and to be honest..I'm not sure how that works. I'll go through my books that I have, however I'm not familiar on how to do that.

Thanks.

William