.NETGURU
  Search:  
NamespacesDiscussions.NET v1.1Dot Net Guru's BlogIT Certification
VB.net WMI Win32_NtlogEvent problem, please help
Messages   Related Types
This message was discovered on microsoft.public.dotnet.general.
Responses highlighted in red are from those people who are likely to be able to contribute good, authoratitive information to this discussion. They include Microsoft employees, MVP's and others who IMHO contribute well to these kinds of discussions.
Post a new message to this list...

Jason80 (VIP)
First I wrote some _VBScript to get info from OS, and now I wrote some code
in VB.Net, and I have a problem now.

Look at this script in vbs

List1.vbs:

strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

strWQL="SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE
TargetInstance ISA ""Win32_NTLogEvent"" "

Set objEventSource = objWMIService.ExecNotificationQuery(strWQL)

Do

Set objLatestEvent = colMonitoredEvents.NextEvent

Wscript.Echo "OK"

Loop

I use it to register the Win32_ntlogEvent , so that i can get some info
where a new log written into the logfiles. List1 works very well on Windows
2003 Server, but when I try it on Windows 2000 Server, it echoed the
connection was refused .

So I edited it into List2,

strComputer = "."

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=
impersonate, (Security)}!\\" & strComputer & "\root\cimv2")

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _

("Select * from __instancecreationevent WITHIN 5 where TargetInstance
isa 'Win32_NTLogEvent' ")

Do

Set objLatestEvent = colMonitoredEvents.NextEvent

Wscript.Echo "OK"

Loop

and list2 works well on Window2000. i noticed the security setting so when I
wrote the code(List3) in vb.net, I added

" watcher.Scope.Options.Impersonation = ImpersonationLevel.Impersonate

watcher.Scope.Options.Authentication = AuthenticationLevel.Default

" options in the vb.net code, but the bin still can not run on windows2000,
while it works well on Server2003.

i am puzzled! : ( ,

List3:

Imports System.management

Module Module1

Sub main()

Dim eventQuery As New EventQuery("SELECT * FROM
__InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' ")

'Initialize an event watcher object with this query

Dim watcher As New ManagementEventWatcher

watcher.Scope.Path.Server = "."

watcher.Scope.Path.Path = "\\.\root\CIMV2"

watcher.Scope.Path.NamespacePath = "root\CIMV2"

watcher.Scope.Options.Impersonation = ImpersonationLevel.Impersonate

watcher.Scope.Options.Authentication = AuthenticationLevel.Default

watcher.Scope.Options.EnablePrivileges = False

watcher.Query = eventQuery

watcher.Start()

MsgBox("Listening started！")

Dim handler As New EventHandler

AddHandler watcher.EventArrived, AddressOf handler.HandleEvent

System.Threading.Thread.Sleep(-1)

End Sub

End Module

Public Class EventHandler

Public Sub HandleEvent(ByVal sender As Object, ByVal e As
EventArrivedEventArgs)

Console.Write("OK")

End Sub

End Class

but after I changed the Query String to :

'Dim eventQuery As New EventQuery("SELECT * FROM __InstanceCreationEvent
WHERE TargetInstance ISA 'Win32_NTLogEvent' and TargetInstance ='Application'
")

The bin could run well under windows2000 too, but if you change the
targetinstance to Security, you get the access denied message again.

So finally i have two questions:

Why can not i register to the Win32_NtlogEvent, bu t i can register to the
application part in Win32_ntlogevent?

Is that a security problem?

Thank you for you time.
Reply to this message...
 
    
MarkD VIT@UK (VIP)
Hello Jason,

I am not an expert on this but I have written some vb.net code to do
something similar. My understanding is the even if you run this with an
administravtive level account some security permissions are not enabled
unless you explicitly do so.

The line "watcher.Scope.Options.EnablePrivileges = True" allows me to do the
same type of thing.

I have bene running this code on Win XP SP1, Win XP SP2, Win2003, Win2000
Server under .Net 1.1 without any problems. I have upgraded a few test
machines for .Net 1.1 SP1 and I now have security related problems (access
denied on the watcher start command).

The access deinied is driven by trying to access the "security" logfile.
This may be the case for you. I have used the command

Dim q As New WqlEventQuery( _
"__InstanceCreationEvent", _
New TimeSpan(0, 0, 10), _
"TargetInstance ISA ""Win32_NTLogEvent"" " & _
"and (" & _
"TargetInstance.LogFile = ""Audit Success"" or " & _
"TargetInstance.LogFile = ""Audit Failure"" or " & _
"TargetInstance.LogFile = ""Application"" or " & _
"TargetInstance.LogFile = ""System"" " & _
")")

which explicitly identifies the logfiles of interest (and does not require
EnabledPrivilages to be set to true).

I hope this helps,
Mark

"Jason80" wrote:

[Original message clipped]
Reply to this message...
 
    
Jason80 (VIP)
Thank you for your answer, and i have tried the
"watcher.Scope.Options.EnablePrivileges = True"
but i still can not access the whole "Win32_NtlogEvent" class,
and i can access Application, System. So strange.

Thank you anyway, hope you can get your answer soon

"MarkD VIT@UK" wrote:

[Original message clipped]
Reply to this message...
 
    
Jason80 (VIP)
Thank you for your answer, and i have tried the
"watcher.Scope.Options.EnablePrivileges = True"
but i still can not access the whole "Win32_NtlogEvent" class,
and i can access Application, System. So strange.

Thank you anyway, hope you can get your answer soon

"MarkD VIT@UK" wrote:

[Original message clipped]
Reply to this message...
 
    
MarkD VIT@UK (VIP)
Hi Janson,

There was another discussion I had on this subject in the
microsoft.public.dotnet.framework group - the subject was

Subject: Problem with .NET 1.1 SP1 - Events

This may help give more details on the subject.

Thanks,
Mark

"Jason80" wrote:

[Original message clipped]
Reply to this message...
 
 
System.Console
System.EventHandler
System.Management.AuthenticationLevel
System.Management.EventArrivedEventArgs
System.Management.EventQuery
System.Management.ImpersonationLevel
System.Management.ManagementEventWatcher
System.Management.WqlEventQuery
System.Threading.Thread
System.TimeSpan




ExamGuru IT Solutions - .Net Guru is owned and operated by ExamGuru, Inc., the man behind .Net Guru. If you're in the market for bespoke software or software consultancy, why not get him and his highly trained team to help? - www.examguru.net/ITCertification
Ad


Need Dot Net Interview Questions?
Ask ExamGuru, Inc. for advice and help on Passing .Net Interviews
.Net Projects
Best-of-breed application framework for .NET projects, developed by ExamGuru, Inc. and ExamGuru IT
Free .net Help
Commission ExamGuru, Inc. and his team for your next bespoke software project
FogBUGZ
The only bug tracking system carefully crafted with one goal in mind: helping teams create great software.
Awesome Tools
If you don't know about these, you're missing out... IT Certification Questions
IT Interview Questions
Free Oracle 10g Training
MCSE Boortcamp
Cisco Study Guides
Cheap Study Guides
Exact Questions
Dot Net Interview Questions
Oracle OCP
Cheap Travel
Designer Perfumes - Wholesale Prices
Free Programming Tutorials
 
ExamGuru IT Solutions - .Net Guru is owned and operated by ExamGuru, Inc., the man behind .Net Guru. If you're in the market for bespoke software or software consultancy, why not get him and his highly trained team to help? - www.examguru.net/ITCertification
 Copyright © ExamGuru, Inc. 2001-2006
Contact Us - Terms of Use - Privacy Policy - www.dot-net-guru.com - www.examguru.net - www.oraclesource.net - www.itinterviews.net - www.examguru.net/ITCertification