How to read event viewer

I want to view all events as we can see through event viewer in administrative tool in control panel using a java program
how can i view application ,security ,system and w3c events as in events viewer in java program ???

Hi
AEM data is stored in SCOM, you can use sql commands to connect to SCOM db and get required data.
refer below for how to run sql query from PowerShell
http://technet.microsoft.com/en-us/library/cc281720.aspx
for SQL query for AEM refer below link
http://blog.scomfaq.ch/2013/05/14/scom-2012-custom-aem-reports/
http://blogs.technet.com/b/kevinholman/archive/2007/10/18/useful-operations-manager-2007-sql-queries.aspx
Note : you can retrieve AEM data from scom sdk but it will overload scom server, however scom sdk run sql query to get required data. you can use sql PowerShell commands to achieve the same
Regards
sridhar v

Similar Messages

How to interpret Event Viewer reference to "\Device\Harddisk3\DR3"

My Win 7 Event Viewer is showing error messages saying
> The driver detected a controller error on \Device\Harddisk3\DR3.
and I need to relate that to a particular drive. Is "DR3" = "Disk 3" in the Disk Management console? If not, how do I determine the unit responsible for the error?

I think you should forget about the "DR3" and just look at "Harddisk3" instead. On this computer the Harddisk number corresponds to the Disk number in Disk Management.
Looking in both "Globals" and "Devices" in Winobj, I think that \Device\Harddisk3 is a namespace and DR3 seems to represent the device (Harddisk3) within that namespace.
As noticed by Fleet Command in the afore-mentioned thread, removing and replugging a USB drive increments the "DR" number - for example, \Device\Harddisk7\DR7 becomes \Device\Harddisk7\DR8 and then \Device\Harddisk7\DR9 etc.
Also, my System drive (\Device\Harddisk0\DR0) and my RAM drive (\Device\Harddisk5\DR0) both use "DR0"
Looking at the partition entries for all drives in "Devices", Partition0 seems to always be a symbolic link to the drive itself eg HardDisk3\Partition0 points to Harddisk3\DR3 (try double clicking on Partition0). Also, GPT drives seem to have another
extra partition listed. For example, in the Devices screenshot below Partition 0 through 5 are listed. After discounting Partiton0, that still leaves 5 partitions. The drive actually only has 4 partitions. All my GPT drives are the same - they show an extra
partition - yet all the MBR drives show the "correct" number (but maybe there is another explanation).
Anyway, most of my drives have a unique number of partitions and, at least on this computer, at this moment, the "Harddisk" number corresponds with the drive index as shown the left hand side of the bottom half of Disk Management - ie \Device\Harddisk3
corresponds to Disk 3
Double clicking on PhysicalDrive3 in the Globals section of Winobj (as below)
Brings you here

How to read or view information (ldf) File And find out operations update or drop or insert for tables ?

I'm want read Ldf log and find out all event for database ???

I'm want read Ldf log and find out all event for database ???
hello,
You can use below undocumented commands( you cannot completely read it but below commands will surely be helpful).Any specific requirement you have from log files
select * from fn_dblog()
dbcc loginfo(db_name)
dbcc log
simiilar discussion
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/5aea4dab-8d84-4515-b686-202e329ad2b6/how-to-open-or-read-sql-server-log-file-ldf?forum=sqlgetstarted
http://stackoverflow.com/questions/9767054/read-the-log-file-ldf-in-sql-server-2008
Please mark this reply as the answer or vote as helpful, as appropriate, to make it useful for other readers

How to read event triggered by FM "BP_EVENT_RAISE"

Hi Experts,
Is there any way by which i can come to know if a particular event has been triggered by above function Module programmatically (by any table read or Function module).
Thanks
Yogesh Gupta

Go to that Function Module from SE37 Transaction and click on button 'Where Used List', Select Programs, Classes, Function modules... You will get list of objects which have been used this Function Module.
Regards,
Satish

How to read iCal events from SQLite Cache file?

I need to figure out how to read event entries in the Cache file stored in /Library/Calenders/ as my actual events have been corrupted due to a file system problem. The example below shows the information I have for each entry, where the event in the entry was Bon Jovi Concert, however I am confused how I can read the date and time of the event, information I believe is stored as 218215639,219613081,219524400,219540600. Any help is greatly appreciated.
INSERT INTO "ZCALENDARITEM" VALUES(0,NULL,0,NULL,0,5,NULL,6,4039,NULL,0,0,0,0,0,0,2,23,0,0,0,0,6,0,21821563 9,219613081,219524400,219540600,NULL,NULL,NULL,NULL,NULL,'local_AFB8D342-2DAE-4F A1-A9A6-3FA9B28B5C7C','Bon Jovi Concert',NULL,NULL,NULL,'Europe/London',NULL,'0E17BBB6-0E76-4024-8DD7-60E43D38D 35B');

OK, here we go ... I hope. I have tried it on my iCal, with about 2000 entries, and it worked. I cannot guarantee that it will work for you.
Make a new text file from sql as before, but using this modified command to get additional data for each event:
sqlite3 Desktop/Hope 'select ZSTARTDATE, ZCALENDARITEM.ZTITLE, ZENDDATE, ZNODE.ZTITLE, ZISALLDAY, ZRECURRENCERULE, ZISDETACHED from ZCALENDARITEM inner join ZNODE on ZCALENDARITEM.ZCALENDAR = ZNODE.Z_PK where ZSTARTDATE not null' >hope.txt
I suggest you make a new user account, then copy the text file hope.txt and the script to the Public/Drop Box folder for that account. Log on to the new account and copy the two files from the drop box to the Desktop. Start iCal and make new calendars to match those in your ordinary account. Double click the script to open it in Script Editor and CHANGE THE DATE RANGE in the "set ThePeriod" line. Stand well back and click the run button. Every 50 records processed it will pop up a progress box, which will pop down again after a second. Go for lunch.
When it is finished see if things look OK in iCal. If they do export each of the calendars, copy them to the drop box of your normal account and return to your normal account to import them.
If there is an error make a note of the error message and line number, find that line in the text file, and post it here with a couple of lines either side.
Note that for recurring items iCal normally only makes a single event, the first occurrence, then uses a recurrence rule to calculate if the event should be displayed in the current window. If there are any recurring events in the period you have selected where the first occurrence is before the period they will not be recreated. Where however you have changed a single occurrence of a recurring event iCal makes a new, detached, event. Any of these in the period will be detected. If their original event was also in the period they will now appear in the iCal display as duplicates. For easy spotting of these, I have prefixed "XX-" to the title of any detached events.
AK
<pre style="font-family: 'Monaco', 'Courier New', Courier, monospace; overflow:auto; color: #222; background: #DDD; padding: 0.2em; font-size: 10px; width:400px">on run
set ThePeriod to {date ("jan 1 2008"), date ("dec 31 2008")} --CHANGE THIS BEFORE RUNNIN
set TheFile to open for access (path to desktop as text) & "temp.txt"
set TheContents to read TheFile --until return
close TheFile
set TheLines to paragraphs of TheContents
set OldDelim to AppleScript's text item delimiters
set AppleScript's text item delimiters to {"|"}
set LCount to 0
set ACount to 0
set RCount to 0
set DCount to 0
set SCount to 0
set HowMany to (count of TheLines)
try
repeat with ThisLine in TheLines
if (count of ThisLine) is 0 then exit repeat
-- Start Date, Title, End Date, Calendar, All Day, Recurs, Detached
set LCount to LCount + 1
set Details to text items of ThisLine
set MyStartDate to FixMyDate(item 1 of Details)
set MyTitle to item 2 of Details
set MyEndDate to FixMyDate(item 3 of Details)
set MyCalendar to item 4 of Details
set MyAllDay to item 5 of Details
set MyRecurs to item 6 of Details
set MyDetached to item 7 of Details
if MyAllDay is "1" then set ACount to ACount + 1
if (count of MyRecurs) > 0 then set RCount to RCount + 1
if MyDetached is "1" then set MyTitle to "XX-" & MyTitle
if MyDetached is "1" then set DCount to DCount + 1
if (MyCalendar is not "Birthdays") and (MyStartDate ≥ item 1 of ThePeriod) and (MyStartDate ≤ item 2 of ThePeriod) then
tell application "iCal"
tell calendar MyCalendar
set ThisItem to make new event at end of events with properties {summary:MyTitle, start date:MyStartDate}
end tell
tell ThisItem
if MyAllDay is "1" then set allday event to true
if (count of MyRecurs) > 0 then set recurrence to MyRecurs
set end date to MyEndDate
end tell
end tell
else
set SCount to SCount + 1
end if
if (LCount mod 50) = 0 then
set the_message to "Processed " & (LCount as string) & " of " & (HowMany as string)
display dialog the_message buttons {"Cancel"} giving up after 1
end if
end repeat
on error TheError
display dialog "Error: " & TheError & " about line " & LCount
end try
set AppleScript's text item delimiters to OldDelim
display dialog (LCount as string) & " lines processed" & return & "All Day: " & (ACount as string) & return & "Recurs: " & (RCount as string) & return & "Detach: " & (DCount as string) & return & "Skipped: " & (SCount as string)
end run
on FixMyDate(MyDate)
date (do shell script "date -r " & MyDate & " -v+31y +%e'/'%m'/'%y' '%T")
end FixMyDate
</pre>

Windows 8.1 event viewer logs.

I am looking for the windows 8.1 event viewer logs and settings, online search fails to produce answer, and suggested .msc commands are not valid.

Hi @butface ,
Thank you for visiting the HP Support Forums and Welcome. I have looked into your issue with your Windows 8.1 and the event viewer. Here is how to open Event Viewer by clicking the Start button, clicking Control Panel, clicking System and Security, clicking Administrative Tools, and then double-clicking Event Viewer.
I would be happy to assist if needed as there are many models of HP Notebook ,
I would need the model number. How Do I Find My Model Number or Product Number?
Please let me know.
Thanks.
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the bottom to say “Thanks” for helping!

Read a view Object parameter value

can anyone tell me how to read a View Object parameter value from inside a DODML()?
Thanks

Please help us to understand the use case better. Can you please details the scenario? Are you looking for the bind variable value used for querying ?

How to get event from message?

Hi,All:
I write a run-time interface by CVI, I use TS_EngineRegisterUIMessageCallback to register my callback function, but when message passed to the callback function, as the type is struct IDispatch but not CAObjHandle, I don't know how to read event from message.
Can you help me to solve it? Thanks
Chang Zhang

Hello Chang-
If your question is simply how to obtain an object handle from an object of type IDispatch, have you investigated the function "CA_CreateObjHandleFromIDispatch"? I would recommend you look over the testexec.prj that is installed along with the TestStand engine (the CVI Operator Interface) and inspect how we handle our callbacks, this may help you understand how to go about emulating the behavior in your own project. To see this particular function in use it may be most helpful to look in the file 'engine.c' and inside the function UIMessageDeferredCallback here you will see the IDispatch pointer being handled and decoded for use by the TS engine.
Regards,
Elaine R.
Applications Engineering
National Instruments
http://www.ni.com/ask

How do you split clips in the event viewer in iMovie '11?

I'm using iMovie '11 and have imported a very long movie (over an hour from VCR Tape) that I want to split into multiple events, however the "Split Clip" option is grayed out. How can I split a large event into smaller events?

I have discovered a round-about way to split large events from comments in this forum, so apologies, and or thanks to other posters.
You can split events by deleting (and discarding) a single frame at the point where you want to split the two clips. It's processor intensive (takes a while to do), but it works.
1.) In the Event Viewer, click to select where you want to split the event.
2.) Drag the yellow handles to make the selection as small as possible (1 frame?). If you drag the thumbnail display slider to the left to show only 1/2 second intervals, it helps when selecting a single frame.
3.) Right click and select "Reject Selection". The clip is now split.
4.) When you've completed all of your clip splitting, select "Show: Rejected Only" at the bottom of the Event Viewer to show all of the rejected frames.
5.) Click on "Move Rejected to Trash". This operation could take a while.
That should be it.
Hope this helps.

How to Read FPM Events in WDDOBEFOREACTION

Dear All,
I am working on a GAF solution. If the user clicks the PREV or EXIT buttons I want to skip the Check the mandatory field validations. But do not know how to read the FPM Events inside the WDDOBEFOREACTION method inside the View.
Any help is greatly appreciated.
Thank you.
PK

Hi,
Below code can be used to get the current executed FPM event.
DATA io_event type cl_fpm_event.
io_event = wdevent->get_string( 'ID' ).
io_event will have the Event which is being triggered.
FPM event can be captured in WDDOBEFOREACTION, but since this hook method is invoked before any events in the view, so it will throw a dump , if any action is triggered other FPM event.
So it is better to write the validation in Component controller method,(ON_PROCESS ), if we want to Validate based on prev and next buttons.
DATA io_event type cl_fpm_event.
CASE io_event->mv_event_id .
WHEN cl_fpm_event=>'NEXT'. " Global constants can be declared like gc_event_edit,etc
Endcase.
Regards,
Harsha J

How does one clear Custom Views (Administrative Events) in the Event Viewer?

Windows Logs and Applications and Services Logs have a "clear log" option; however, I am puzzled how to edit/delete Administrative Events?Eighter from Decatur, county seat of Wise (of course it's in Texas)

Ronnie Vernon said: Hi p010ne
The Custom View / Administrative Events is a compilation of all the other event logs in the Event Viewer.
Entries in this log will be removed when the log where the event originated from is cleared.
Hope this helps.
Ronnie Vernon MVP
I thought that was the case; however, I cleared all the other logs! This is an example of an entry in this log: Log Name: Microsoft-Windows-Dhcpv6-Client/AdminSource: Microsoft-Windows-DHCPv6-Client
Date: 1/17/2009 7:52:33 AM
Event ID: 1001
Task Category: Address Configuration State Event
Level: Error
Keywords:
User: LOCAL SERVICE
Computer: Windows7
Description:
Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0x000129F558C5. The following error occurred: 0x79. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
   <Provider Name="Microsoft-Windows-DHCPv6-Client" Guid="{6A1F2B00-6A90-4C38-95A5-5CAB3B056778}" />
   <EventID>1001</EventID>
   <Version>0</Version>
   <Level>2</Level>
   <Task>3</Task>
   <Opcode>74</Opcode>
   <Keywords>0x8000000000000000</Keywords>
   <TimeCreated SystemTime="2009-01-17T13:52:33.858398400Z" />
   <EventRecordID>202</EventRecordID>
   <Correlation />
   <Execution ProcessID="1088" ThreadID="864" />
   <Channel>Microsoft-Windows-Dhcpv6-Client/Admin</Channel>
   <Computer>Windows7</Computer>
   <Security UserID="S-1-5-19" />
  </System>
  <EventData>
   <Data Name="HWLength">6</Data>
   <Data Name="HWAddress">000129F558C5</Data>
   <Data Name="StatusCode">121</Data>
  </EventData>
</Event>
When I search for "Microsoft-Windows-DHCPv6-Client" I do not find that file?
OK, I found the entrys in the Microsoft section (DHCPv6-Client) and am able to clear them there!
Eighter from Decatur, county seat of Wise (of course it's in Texas)

How to dowload IDS event viewer 4.1?

Dear Sir,
I have IDS 4215 now I can access to IDM by IE6 but I don't know how to dowload IDS event viewer.
Can you help me,
Thanks very much
NhuongPham

The addition of IEV and the IEV signature updates made the sensor updates to large (sometimes doubling the size of the updates).
We have several customers that are monitoring sensors on a global network.
Many of the sensors are connected through low bandwidth connections.
The large updates were causing delays in getting signature updates loaded on these remote sensors.
It became a priority to reduce the size of the updates needing to be pushed to the remote sensors.
These customers are generally using Security Monitor rather than IEV because of the large number of sensors being managed.
So the customers who were not using IEV were having problem because of the additional IEV files having to be pushed to their sensors when they would never use these IEV files.
So it was decided to remove the IEV updates from the sensor updates and separately post these on CCO.
IEV customers were already having to make 2 downloads: the sensor update download from CCO, and the IEV download from the sensor.
So now both downloads are just made from CCO.

How to create EVENTS for a View Cluster.

Hi Tech Gurus,
I have created a view cluster on 5 tables. I need to do a validation and this can be done by using events. But i am unable to create a EVENT for the View Cluster. Could anyone please tell me how to create events for a View Cluster.
Thanks in advance for your esteemed replies.
Regards,
Raghavendra Goutham P.

Hello Pasapula
When you are in the View Cluster maintenance dialog (SE54) click on dialog "Events".
Below the field for the view cluster you have an additional field <b>FORM routines main program</b>. There you have to add the main program containing the FORM routines called by the VC events.
For example: I had defined a normal report containing an include with all the FORM routines. The report contains only the following lines of coding:
report zus_0120_u1.
* Common Data und access routines for user exits in VC maintenance
include LSVCMCOD.
include zus_0120_f1. "FORM routines for VC events
Now in the "Events" dialog of the view cluster maintenance you assign your FORM routines to the events.
Regards
Uwe

How to Call Event Handler Method in Another view

Hi Experts,
                   Can anybody tell me how to call Event handler Method which is declared in View A ,it Should be Called in
view B,Thanks in Advance.
Thanks & Regards
Santhosh

hi,
1)    You can make the method EH_ONSELECT as public and static and call this method in viewGS_CM/ADDDOC using syntax
    impl class name of view GS_CM/DOCTREE=>EH_ONSELECT "method name.
             or
2)The view GS_CM/ADDDOC which contains EH_ONSELECT method has been already enhanced, so I can't execute such kind of operation one more time.
                     or
3)If both views or viewarea containing that view are under same window , then you can get the instance ofGS_CM/DOCTREE from view GS_CM/ADDDOC through the main window controller.
lr_window = me->view_manager->get_window_controller( ).
    lv_viewname = 'GS_CM/DOCTREE '.
lr_viewctrl ?= lr_window ->get_subcontroller_by_viewname( lv_viewname ).
Now you can access the method of view GS_CM/DOCTREE .
Let me know in case you face any issues.
Message was edited by: Laure Cetin
Please do not ask for points, this is against the Rules of Engagement: http://scn.sap.com/docs/DOC-18590

How do you change the Event Viewer archive location in Server 2008 R2?

We're wanting to redirect the security and system event viewer logs to the D:\ on a Server 2008 R2 box
We've got the current logs to save there, however all archived system/security logs are still being saved on the c:\ in their default location in %windir%\system32... and killing the OS partition.
I can write something up in PoSh and schedule it, but I'd rather use any built-in capabilities first...
I've taken a peek in the HKLM\Services\CurrentControlSet... hive where the event viewer behavior is configured and do not see an option to set a path for the archive location...

Unfortunately, you cannot customize the location of archived event logs in Windows. The logs will always be archived to %windir%\system32\Winevt\Logs\Archive-xxxxxx
There'd be some scripts can help you automatically archived logs to another location. You can find them here: http://gallery.technet.microsoft.com/scriptcenter/site/search?f%5B0%5D.Type=RootCategory&f%5B0%5D.Value=security
Regards,
Zhang
TechNet Subscriber Support
If you are
TechNet Subscriptionuser
and have any feedback, please send your feedback here.

How to read event viewer

Similar Messages

Maybe you are looking for