Search code examples
pythonreadeventlog

Reading windows event log using win32evtlog module


Below is the code, It's giving the total 87399 number of the log, but when reading the logs it only returns a 7 record list.

import win32evtlog

server = 'localhost'
logtype = 'Application'
hand = win32evtlog.OpenEventLog(server,logtype)
flags = win32evtlog.EVENTLOG_SEQUENTIAL_READ | win32evtlog.EVENTLOG_BACKWARDS_READ
total = win32evtlog.GetNumberOfEventLogRecords(hand)
events=win32evtlog.ReadEventLog(hand,flags,0)
print "Total number of Event record ",total  #Returning 87399
print "Log record read",len(events)  #Returning 7

for event in events:
    print 'Event Category:', event.EventCategory
    print 'Time Generated:', event.TimeGenerated
    print 'Source Name:', event.SourceName
    print 'Event ID:', event.EventID
    print 'Event Type:', event.EventType
    print 'Computer Name:', event.ComputerName
    print 'Data Name:', event.Data
    print type(event)

How to read all log records?

Thanks in advance


Solution

  • import win32evtlog # requires pywin32 pre-installed
    
    server = 'localhost' # name of the target computer to get event logs
    logtype = 'System' # 'Application' # 'Security'
    hand = win32evtlog.OpenEventLog(server,logtype)
    flags = win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ
    total = win32evtlog.GetNumberOfEventLogRecords(hand)
    
    while True:
        events = win32evtlog.ReadEventLog(hand, flags,0)
        if events:
            for event in events:
                print 'Event Category:', event.EventCategory
                print 'Time Generated:', event.TimeGenerated
                print 'Source Name:', event.SourceName
                print 'Event ID:', event.EventID
                print 'Event Type:', event.EventType
                data = event.StringInserts
                if data:
                    print 'Event Data:'
                    for msg in data:
                        print msg
                print
    

    Note: use while true to loop through the events so that we can get each event.