MonitorWare Knowledge Base

Hi all,

I have put up a database of Windows Events at

http://www.monitorware.com/en/events/

This list includes complete parsing information for all events we know of.

Rainer

Hi, starting with W2K Microsoft provides 3 additional Eventlogs. I don't see the one for Directory Service. In the Eventlog Report you only provide the events from the following 5 Logs.

Application(1011)
DNS Server(154)
File Replication Service(17)
Security(253)
System(5189)

Are you going to provide information about the Directory Service Evetnlog as well?

Best regards
Dietmar

It's just a matter of finding time and information. If you have anything, please provide it, so that we can add it. I have to admit that this free service is not a priority, so it sometimes grows slowly...

Rainer

It's a bit old, but has a lot of event IDs that might be useful to put into your database:

http://support.microsoft.com/default.as ... -us;117304

Hi all,

Is there any System event that will be invoked every time a new process is started in a machine. if there is any can i retrieve the name of the exe/process that is running.

waiting for u r much needed help

Thanks in advance

I don't have the specifics at hand, but this can be done via the auditing events. These events need to be turned on. I guess it is part of object access.

Hopefully this points you into the right direction. If you find out the details, I'd appreciate if you could post them.

HTH
Rainer

Thank gerhards,

I was able to find the system event that occurs for process creation. The event id is 592 and u can find this event being logged in your security audit log. for this to be viewed one needs to turn on Event viewer service in windows Xp.


But i have a problem. I wanted to catch the process create event. So i decided that i would use WMI to catch the process creation event. I wrote a WMI Query which is as given below:

SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.ExecutablePath = 'C:\Program Files\Outlook Express\msimn.exe'


This query was called as a part of ExecNotificationQueryAsync() function in the WMI component. This query is not actually catching the process creation event for Outlook express process("msimn.exe").

But the query when changed a little bit

SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'

works well and catches every process that is created. Can any body help me in this regard