#676 win32evtlog.OpenEventLog cannot open log under "Applications and Services Logs"

[Florian]

I tried a lot of different ways to open one of the log files listed under "Applications and Services Logs" in the Eventlog of Windows 7/2008 R2.
Accessing these logs always resulted in an opened "Application" log which has in my case 9635 entries.

File:
%SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-TaskScheduler%4Operational.evtx

Example Code:
hand = win32evtlog.OpenEventLog(None,"Microsoft-Windows-TaskScheduler/Operational")
print win32evtlog.GetNumberOfEventLogRecords(hand)
9635

[Florian]

Found some hints here:

http://social.msdn.microsoft.com/Forums/en-US/882df3d5-9a9b-437b-a6ab-e09873ce6ece/cant-access-event-log-for-tasks?forum=csharplanguage

[Florian]

Found a workaround (that sucks, as you have to edit the registry to make it work).
I tried it and it worked. Is it possible to adapt the "OpenEventLog" Function to assume that this registry key exists and simply access the log?

https://support.zoho.com/portal/manageengine/helpcenter/articles/monitoring-the-custom-eventlog-in-opmanager

[Roger Upole]

You can access the Application and Services logs using the newer Evt* functions introduced with Vista.

[Florian]

When I try this the Python process crashes.

I use the current Python 2.7.7 32bit on Windows 7 x64.
Pywin32 build 219
Running the script with Administrator rights

Code:
logtype = "Microsoft-Windows-Windows Defender/Operational"
hand = win32evtlog.EvtOpenLog(logtype, 1, None)
total = win32evtlog.GetNumberOfEventLogRecords(hand)

[Roger Upole]

Handles aren't portable between the older event log functions and the newer Evt* functions. To get the number of event in the log, try
win32evtlog.EvtGetLogInfo(h, win32evtlog.EvtLogNumberOfLogRecords)

[Florian]

Ahh - thank you. Now I see.
I cannot close this ticket but I consider it closed.

[Florian]

No wait.
Running this on Windows 2003 completely crashes the python process. I cant handle this with a try catch statement:

hand = win32evtlog.EvtOpenLog(logtype, 1, None)