I am trying to create a python application that can use the event viewer to detect startup, shutdown, BSOD, Windows Update etc. events and write them to a file.
However I found that I am not getting all the events and I am not getting the events that I am looking for (e.g. Event ID 6005 and 6006 - service startup and shutdown)
After some debugging I discovered that I am only retrieving events where the "User" is "System". How do I change this to retrieve events from all users?
Here is my code so far:
import win32evtlog, win32evtlogutil
computer = None # Work on the local machine only
logType = "System"
verbose = False
h=win32evtlog.OpenEventLog(None, logType)
numRecords = win32evtlog.GetNumberOfEventLogRecords(h)
numRead = 0
numFiltered = 0
print("Number of Records " + str(numRecords))
f = open("evts.txt", "a")
while 1:
objects = win32evtlog.ReadEventLog(h, win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ, 0)
if not objects:
break
for object in objects:
event_id = object.EventID
if event_id > 2000 and event_id < 6006:
msg = win32evtlogutil.SafeFormatMessage(object, logType)
f.write(str(object.EventID) + "\t| " + str(object.EventType) + "\t| \n" + msg)
numFiltered = numFiltered + 1
numRead = numRead + len(objects)
print("Number of events read: " + str(numRead))
print("Number of filtered events: " + str(numFiltered))
f.close()
The output from this code only returns events with ID 4000 and 4001, but I can see much more in the Windows Event Viewer
PS:
- Running the script as Administrator in Windows 10 does not seem to fix the problem.
- I am using Python 3.7.5 (64 Bit) on windows 10 with a virtual environment