How do I use PyWin32 to get events for all users?

Viewed 178

I am trying to create a python application that can use the event viewer to detect startup, shutdown, BSOD, Windows Update etc. events and write them to a file.

However I found that I am not getting all the events and I am not getting the events that I am looking for (e.g. Event ID 6005 and 6006 - service startup and shutdown)

After some debugging I discovered that I am only retrieving events where the "User" is "System". How do I change this to retrieve events from all users?

Here is my code so far:

import win32evtlog, win32evtlogutil

computer = None # Work on the local machine only
logType = "System"
verbose = False

h=win32evtlog.OpenEventLog(None, logType)
numRecords = win32evtlog.GetNumberOfEventLogRecords(h)
numRead = 0
numFiltered = 0
print("Number of Records " + str(numRecords))
f = open("evts.txt", "a")
while 1:
    objects = win32evtlog.ReadEventLog(h, win32evtlog.EVENTLOG_BACKWARDS_READ|win32evtlog.EVENTLOG_SEQUENTIAL_READ, 0)

    if not objects:
        break
    for object in objects:
        event_id = object.EventID
        if event_id > 2000 and event_id < 6006:
            msg = win32evtlogutil.SafeFormatMessage(object, logType)
            f.write(str(object.EventID) + "\t| " + str(object.EventType) + "\t| \n" + msg)
            numFiltered = numFiltered + 1
    numRead = numRead + len(objects)

print("Number of events read: " + str(numRead))
print("Number of filtered events: " + str(numFiltered))
f.close()

The output from this code only returns events with ID 4000 and 4001, but I can see much more in the Windows Event Viewer

PS:

  • Running the script as Administrator in Windows 10 does not seem to fix the problem.
  • I am using Python 3.7.5 (64 Bit) on windows 10 with a virtual environment
0 Answers
Related