Outlook start and close event id

Question

I am in the process of writing a batch script to take a backup of my pst file whenever the outlook closes.

I am thinking of having a scheduled task based on windows event id.

I searched for various event id for Microsoft outlook but not able to get the desired.

I tried analyzing the eventvwr but not able to find the desired.

I am using Windows 7 Professional 64 bit, Outlook 2010. I am looking for the start and stop event id for outlook

Answer 1

So as I said before as far as I know there is no Event for Outlook Start/Close, if you have AddIns installed you could use the ID:45 to detect the Startup but still you don´t have a close Event!

The only way to get a Event on Outlook Start/Close is to make it on your own, either via a Outlook AddIn or an VBA-Makro executing on Outlook Startup and Quit Event.

Sample for Outlook AddIn:

public partial class ThisAddIn
{
    private EventLog log = null;

    private void ThisAddIn_Startup(object sender, System.EventArgs e)
    {
        log = new EventLog();
        log.Source = "OutlookAddIn";
        log.Log = "Application";
        log.WriteEntry("Outlook start", EventLogEntryType.Information, 1);
    }

    private void ThisAddIn_Shutdown(object sender, System.EventArgs e)
    {
        if (log != null)
        {
            log.WriteEntry("Outlook stop", EventLogEntryType.Information, 0);
        }
    }

    #region VSTO generated code

    /// <summary>
    /// Required method for Designer support - do not modify
    /// the contents of this method with the code editor.
    /// </summary>
    private void InternalStartup()
    {
        this.Startup += new System.EventHandler(ThisAddIn_Startup);
        this.Shutdown += new System.EventHandler(ThisAddIn_Shutdown);
    }

    #endregion
}

UPDATE

I´ve tried the VBA Solution by myself and it worked ;-)

Create a Module with the following code (Source)

Option Explicit

  Declare Function RegisterEventSource Lib "advapi32.dll" Alias _
    "RegisterEventSourceA" (ByVal lpUNCServerName As String, _
    ByVal lpSourceName As String) As Long
  Declare Function DeregisterEventSource Lib "advapi32.dll" ( _
    ByVal hEventLog As Long) As Long
  Declare Function ReportEvent Lib "advapi32.dll" Alias _
  "ReportEventA" ( _
    ByVal hEventLog As Long, ByVal wType As Integer, _
    ByVal wCategory As Integer, ByVal dwEventID As Long, _
    ByVal lpUserSid As Any, ByVal wNumStrings As Integer, _
    ByVal dwDataSize As Long, plpStrings As Long, _
    lpRawData As Any) As Boolean
  Declare Function GetLastError Lib "kernel32" () As Long
  Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" ( _
    hpvDest As Any, hpvSource As Any, _
    ByVal cbCopy As Long)
  Declare Function GlobalAlloc Lib "kernel32" ( _
     ByVal wFlags As Long, _
     ByVal dwBytes As Long) As Long
  Declare Function GlobalFree Lib "kernel32" ( _
     ByVal hMem As Long) As Long

  Public Const EVENTLOG_SUCCESS = 0
  Public Const EVENTLOG_ERROR_TYPE = 1
  Public Const EVENTLOG_WARNING_TYPE = 2
  Public Const EVENTLOG_INFORMATION_TYPE = 4
  Public Const EVENTLOG_AUDIT_SUCCESS = 8
  Public Const EVENTLOG_AUDIT_FAILURE = 10

  Public Sub LogNTEvent(sString As String, iLogType As Integer, _
    iEventID As Long)
    Dim bRC As Boolean
    Dim iNumStrings As Integer
    Dim hEventLog As Long
    Dim hMsgs As Long
    Dim cbStringSize As Long
    hEventLog = RegisterEventSource("", Application.Name)
    cbStringSize = Len(sString) + 1
    hMsgs = GlobalAlloc(&H40, cbStringSize)
    CopyMemory ByVal hMsgs, ByVal sString, cbStringSize
    iNumStrings = 1
    If ReportEvent(hEventLog, _
       iLogType, 0, _
       iEventID, 0&, _
       iNumStrings, cbStringSize, _
       hMsgs, hMsgs) = 0 Then
       MsgBox GetLastError()
    End If
    Call GlobalFree(hMsgs)
    DeregisterEventSource (hEventLog)
  End Sub

And this is how your OutlookSessionApplication File should look like (how to get there) and don´t forget to allow makros or sign the one you´ve written ;-)

   Private Sub Application_Quit()
        Call LogNTEvent("OUTLOOK QUIT", _
              EVENTLOG_INFORMATION_TYPE, 1000)
    End Sub

    Private Sub Application_Startup()
        Call LogNTEvent("OUTLOOK START", _
              EVENTLOG_INFORMATION_TYPE, 1001)
    End Sub