WDumpEvt: presentation

What is WDumpEvt

WDumpEvt is an administration tool that makes it easy to view and manage all the information from Windows NT and Windows 2000 eventlog.

Choose to gather information from the local machine or any workstation or server running Windows NT or Windows 2000 on the network through a simple browse command that lets you point to any available logs of a computer. Just launch the program on this computer and choose what you want to view or report on.

  • View and print:
    • The list of events
    • The list of user sessions
    • The list of failure sessions
    • The list of RAS sessions,
    • The list of print jobs.
  • Dump the data to a file in ASCII-delimited format or CSV format for importing into a database or spreadsheet, or choose HTML format for an easy-to-read display:
    • The list of events
    • The list of user sessions
    • The list of failure sessions
    • The list of RAS sessions,
    • The list of print jobs.
    The resulting file can contain information such as type, number, and category of the event, plus computer name, date, user, description.
  • Dump either one, or all the events, or just from the last dump.
  • Erase or/and save the data in the eventlog.
  • Schedule all these actions thanks to the LogSched service to have regular save, erase or dump.
  • Retrieve properties about eventlog files: events number, begin and end date, file size....

The package is composed of three modules:

WDumpEvt.exe | The main software
LogSched.exe | The tasks scheduling service
DumpEvtlog.dll |
For more details, see: | What's new
 | How to use WDumpEvt
 | How to install and manage the service

Installation/Uninstallation

You need only to unzip the file WDEvt22.zip in a directory to use these tools

You need recent version of some system dll (MFC42.DLL, msvcrt.dll and msvcp60.dll) with this version of WDumpEvt. If you get the message as The ordinal 6876 could not be located in the dynamic link library MFC42.DLL the dll on your system are too old and you must load a newer version. Click here

My the advice is to copy the new dll into the install directory of WDumpEvt and if you install the service, don't copy LogSched.exe into a system directory but run it directly from the WDumpEvt directory

For a remote installation of the service, don't forget to copy the dll too.

To uninstall the software, use the add/remove of the control panel. (Don't forget to uninstall the service before uninstall the WDumpEvt software)

Registration

You can use this software free of charge only for 30 days evaluation period before registering.
Three additional tools usable on command lines are distributed only to registered users:
CDumpEvt | Dump of eventlog.
CDumpSession | Dump of user sessions, failure sessions , RAS sessions and print jobs.
CSavEraLog | Save and erase of the eventlog.

For more details: | License agreement
 | Registration
 | Order form

I need your help

With Windows 2000, I have noticed that some events change their ID and some new one appears. It will be interesting to add some of them in the sessions list. Unfortunately, I have no eventlog to test it on.

If you have an eventlog (Windows NT 4 or Windows 2000) with events that seems interesting to add to my software, please send it to me. I am specially interested by system eventlog with RemoteAccess logon/logoff other than event 20050

Thank for your help.


WDumpEvt: What's new

What's new

Version 2.2: 09/01/2000

  • New output format for the dump: CSV format.
  • New option for the dump: Overwrite an existing file.
  • Dump of the user sessions, failure sessions, RAS sessions and printing jobs directly and with the service. Customized format.
  • Choice of the starting login for the service.
  • Drag and drop of the .evt and .act files.
  • Update of the command line tools.
    If you are a registered user, you should have received these tools by email. Contact me if you didn't receive any yet.
  • Dll creation.
  • Bugs fix:
    • An action sometimes runs twice when you launch it with Execute now
    • The manual execution of an action (with Execute now) doesn't interfere yet with the service.
    • 'Delete an action' works now.

Version 2.1.1: 01/15/2000

  • New context menu for the window of the actions description, and automatic refresh of the actions list.
  • Bugs fix:
    • User name sometime wrong in an event
    • Correction of the crash when you look at the event data.
    • Correction of the crash when you choose the security log after User sessions.

Version 2.1: 12/28/1999

  • Servers list save when you quit the program and load when it starts.
  • New options for the actions:
    • Save/Load of the action in a file.
    • Print the definition of the action.
    • Flag of the state for the last action.
    • Periodic Action (each x minutes or hours).
    • New action type Dump and erase.
    • Add a post command: command executed at the end of an action.
    To add these new features, I have to change the format of the action, so you must redefine your actions.
    The registered users will receive a tool to do it automatically.
  • New option for the dump: add of the dump in an existing file.
  • Bugs fix:
    • Correction of the crash when you choose User sessions after Failure sessions.
    • The comment at the end of the dump file will be removed when you register.
    • Correction of the crash of the service when you modify an action during its execution.

Version 2.0: 10/01/1999

  • New panel with a list viewer (column sort and printing functionalities):
    • A list of events from a complete eventlog or only from a source or a category.
    • A list of user sessions
    • A list of failure sessions
    • A list of RAS sessions
    • A list of printing
  • New option for the dump: type of event (error, warning, information, audit failure, audit success)
  • Change the properties of the eventlog: Size and retention.

Version 2.0 beta 1: 02/25/1999

  • New interface.
  • CDumpEvt tool replaced by a NT service: Eventlog scheduler.
  • Options for Output file format: date format, txt and html format.
  • Dump of a category, a source of an eventlog available.
  • Bilingual version: English/French.
  • Uninstall procedure (in the add/remove program of the control panel).
  • Properties for the evt files in the Windows explorer.

Version 1.2 : 04/30/1998

  • Dump of one category of events.
  • Dump since last dump.
  • Two formats for the date: readable or OLE format.
  • Html output format.
  • You can save the eventlog of a remote computer where you want (and not only on the remote computer).

Version 1.1 : 11/30/1997

  • You can specify the name of the server, when you dump from a file to get the name of the user and the message on the right computer instead of the local computer.
  • Adding link to the online registration


WDumpEvt: presentation

How to use WDumpEvt

  1. You must choose an object in the tree (see below for the meaning of the symbol), or add a new one (computer or file).
  2. Then select the action
    • Double-click on the object to display the list of the events in the right panel
    • With the toolbar
    • With a menu
    • With the context menu (that you display by clicking on the object with the right button of the mouse)
    • And at last, with the context menu of the tray icon (generally on the bottom right corner of the screen)

Main Screen

Structure of the tree:

Meaning of the icons:

  • Local computer
    • Eventlog (security, system or application)
      • Source (depends of the eventlog)
        • Category(depends of the source)
    • User sessions list of user sessions based on events 528 and 538 of the Security eventlog, source Security, category Logon/Logoff.
    • Logon failure list of the sessions attempts based on events with audit failure type from Security eventlog, source Security, category Logon/Logoff.
    • Print list of documents printed based on event 10 of the System eventlog, source Print.
    • RAS list of RAS session based on event 20050 of the System eventlog, source RemoteAccess.
  • Network
    • Domain
      • Computer with Windows NT or Windows 2000
        • ...(see local computer)
      • Computer without Windows NT or Windows 2000
  • Files
    • File you add

TrayIcon menu:

When you launch the software, an icon appears in the task bar at the bottom right corner of your screen. You can display a menu by clicking on the icon with the right button of the mouse.

  • Actions of the day
  • All actions
  • Service management
  • Quit


WDumpEvt:View the list

View the different lists

You obtain the list by double clicking a leaf of the tree of the first panel or with the Display/refresh list choice of the context menu.

  • The list of events if you double click on an eventlog, a source or a category
  • The list of user sessions if you double click on the leaf user sessions
  • The list of failure sessions if you double click on the leaf logon failure
  • The list of RAS sessions if you double click on the leaf RAS
  • The list of printing if you double click on the leaf print

You can stop the list generation by clicking on the list panel.

You can sort the columns by clicking the header of each column. You can reverse the order by clicking again on the header.

You can print the list by clicking on the [image] button or have a print preview by clicking on the [image] button. The column width on the printout is proportional with the width seen on the screen.

List of events

For each event, you can see the properties by double clicking on the line.

You obtain a tree tabs window:

  • One with the general information and the description.
  • One with the data in 3 formats: bytes, words and ASCII.
  • One with the parameters of the description.

Some specific fields:

  • Num: it's the order number in the log.
  • Description: If you list the events of a remote computer, the event description is decoded from this remote computer. If it fails, the description is decoded from the local computer and the word local is added at the end of the description. The description will only show if the software or service is installed.
  • Parameters: this is the specific data of the current event (for example, an error code), which completes the description.
    I have notice that for some descriptions, all these parameters are not used (for example the time service of the service pack).

List of user sessions

This list is built with the 528 and 540 events for the beginning, and the 538 event for the end of the session of the security log, security source logon/logoff category.

For each session, you can have the details by double clicking on the line

Some specific fields:

  • User: name of the user of the session.
    The name is in parenthesis if the user field of the event is empty, and it is the user that has generated the event.
  • Open session process: it can be one of these:
    KSecDD | ksecdd.sys, the security device driver
    User32 or WinLogon\MSGina | winlogon.exe & msgina.dll, the authentication user interface
    SCMgr | The Service Control Manager
    LAN Manager Workstation Service
    advapi | API call to LogonUser
    IIS | Internet Information Server
    NtLmSsp | NT LAN Manager Security Support Provider
  • Authentication: in general MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  • Session type: a number which means
    2 | Interactive session
    3 | Network session (net use, net view or file manager session)
    4 | Batch session
    5 | Service
    6 | Proxy
    7 | Unlock Workstation
  • Domain\user: domain and user name that generated the event.

List of failure sessions

This list is build with the failure audit type event of the security log, security source logon/logoff category.

For each session, you can have the details by double clicking on the line.

Some specific fields:

  • User: name of the user of the session.
    The name is in parenthesis if the user field of the event is empty, and it is the user that has generated the event.
  • Open session process: it can be one of these:
    KSecDD | ksecdd.sys, the security device driver
    User32 ou WinLogon\MSGina | winlogon.exe & msgina.dll, the authentication user interface
    SCMgr | The Service Control Manager
    LAN Manager Workstation Service
    advapi | API call to LogonUser
    IIS | Internet Information Server
    NtLmSsp | NT LAN Manager Security Support Provider
  • Authentication: in general MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
  • Session type: a number which means
    2 | Interactive session
    3 | Network session (net use, net view or file manager session)
    4 | Batch session
    5 | Service
    6 | Proxy
    7 | Unlock Workstation
  • Domain\user: domain and user name that generated the event.
  • Reason: reason of the session failure.
    It is the description of the event, the reason is at the beginning.

List of RAS session

This list is build with the 20050 event of the system log, RemoteAccess source.
Under Windows 2000, this event seems not to be generated. I need your eventlog to implement the new events. Please send me your eventlog.

For each session, you can have the details by double clicking on the line

Some specific fields:

  • Domain\user: domain and user name that generated the event.

List of printing

This list is build with the 10 event of the system logon Print source.

For each print, you can have the details by double clicking on the line.

Some specific fields:

  • Domain\user: domain and user name that generated the event.


WDumpEvt: Save and/or erase

How to save and/or erase an eventlog

  1. Choose the eventlog you want to save/erase. If you choose a remote computer, you must expand the network branch, or add it with the add server choice of the file menu, or with the [image] button of the toolbar.
  2. Choose the action:
    • With the action menu.
    • With the toolbar: for save, [image] for erase, [image] for save and erase.
    • With the context menu you obtain with the right button of the mouse when an eventlog is selected.

Remark

You can save the object only if the specified file doesn't exist and if the directory exists.

If you save the eventlog from another computer, a temporary file is created on the remote computer, and then the file is moved where you specify it. You must have the write permission on the temp directory of the remote computer and there must be enough space in this remote directory.

Don't forget that you can schedule the save and/or erase of your eventlog. See How to schedule an action for more details.


WDumpEvt: Dump

How to dump an eventlog, a source or a category

  1. Choose the object (eventlog, source, category, file or user sessions, failure sessions, RAS sessions or print jobs) that you want to dump.

    If you want to choose an object of a remote computer, you must

    • Expand the network branch to reach it,
    • Add it with the add server choice of the file menu
    • Add it with the button [image] of the toolbar.

  2. Choose the action:
    • With the action menu.
    • With the toolbar: .
    • With the context menu that you obtain with the right button of the mouse when an eventlog is selected.

Shared options

You can dump the object only
  • If the directory exists.
  • If the specified file doesn't exist.
  • Or if you choose the option Append to existing file or the option Overwrite an existing file.

You can select three formats for the output file by choosing the suffix of the file and set several options with the options sheet windows:

  • .TXT suffix: text format. The default separator is the semicolon. You can change it thanks to the options sheet windows.
  • .CSV suffix: The separator is the comma and that could be open with MS-Excel. (Caution, Excel formats sometimes strangely the date). You can change it thanks to the options sheet windows.
  • .HTML or .HTM suffix: don't forget to copy five gif files (default names are failure.gif, success.gif, info.gif, warning.gif, error.gif) in the directory where you save your dump file.

You can choose the format of the date:

  • Either a readable format that can be define with the options sheet windows.
  • Or OLE format, which means real format. It is useful when you import your dump in MS-Access for example.

If you erase the eventlog, the dump since the last dump has no interest and could be empty whereas the log is not empty.

Import file into Microsoft Access

If you import the text file into access, you must import the date as a real but configure the data type as a date.

Dump of the eventlog, sources and categories

You can dump one number of event (by giving its number, you can find some examples of interesting events) of the entire eventlog, since the last dump or one or several type of event as Error, Warning, Information, Success Audit or Failure Audit.

If you want all the type of events, you'd better choose All Types than checked all the buttons, the dump will be quicker.

If you choose the long format, you can have each piece of information in a separate field and not in a sentence as the event viewer does. For example, you can easily have the size and the number of printed pages by users.

The data are formatted to be include in Office applications as Microsoft Excel or Microsoft Access, so the line feed are erased to have one line per event (but for some event with a lot of data as Dr Watson event, the event could be on several lines due to the maximum size of a line in a file). If you want to import the file in Office application, don’t forget to choose the OLE format for the date.

Dump file content

You can add a title line in your output file with the usual format. The software can't guess the number and the content of each field in the long format.

To obtain the description of the event, you must choose the message option. When you dump a remote computer, the description is decoded with remote messages files, if it fails then decodes with local files and the indicator local is added to the message. In this case, the message is decoded only if the software or the service is installed.

If you choose the data hex or/and data ASCII, the event can be on several lines due to the maximum size of a line in a file.

In the data ASCII output, only the printable characters are printed.

Usual format

Event number; event type; name server; date and time (OLE format for MS Office applications or readable format); user name; domain;

Long format

Short format plus information about the event.

To identify this information, you can compare it with the eventlog. The information is given in the same order.

Dump of the user sessions, failure sessions, RAS sessions or print jobs.

Dump file content

Short format

This format only contains the fields:

 | User sessions | Failure sessions | RAS sessions | Print jobs
User | X | X | X | X
Server | X | X | X |
Domain | X | X | X |
Date of the event |  | X |  | X
Session start date | X |  | X |
Session end date | X |  | X |
Duration | X |  | X |
Workstation | X | X | X | X
Document |  |  |  | X

Long format

All the fields of the event.

Customized format

You can choose with this format the fields that interest you and modify the title of each column.

To choose the fields, you must click on the Customize button.

To modify a title, you must select it and then modify the string in the Title control. Don't forget to click on the Modify button to validate the modification.

Dump file content

User sessions

The sessions list is build with the 528 and 540 events for the begin, and the 538 event for the end of the session of the security log, security source logon/logoff category.

Failure sessions

The sessions list is build with the failure audit type event of the security log, security source logon/logoff category.

RAS sessions

The sessions list is build with the 20050 event of the system log, RemoteAccess source.

Under Windows 2000, this event seems not to be generated. I need your eventlog to implement the new events. Please send me your eventlog.

Print jobs

The sessions list is build with the 10 event of the system logon Print source.

Unregistered user

In the unregistered version, a line is added at the end of the file.

Dump sample in txt format for the print source with message

INFORMATION;10;15-02-98 18:36:12;ISABELLE\Administrateur;print;ISABELLE;;Le document 3, Enveloppes étranger possédé par Administrateur a été imprimé sur HP LaserJet 4L via le port LPT1:. Taille en octets : 36124 ; pages imprimées : 2 ;
INFORMATION;10;12-02-98 21:52:26;ISABELLE\Administrateur;print;ISABELLE;;Le document 2, liste par auteurs (verifies) possédé par Administrateur a été imprimé sur HP LaserJet 4L via le port LPT1:. Taille en octets : 404182 ; pages imprimées : 4 ;
INFORMATION;10;10-02-98 21:09:45;ISABELLE\Administrateur;print;ISABELLE;;Le document 3, tit_isa.doc possédé par Administrateur a été imprimé sur HP LaserJet 4L via le port LPT1:. Taille en octets : 157284 ; pages imprimées : 1 ;
INFORMATION;10;10-02-98 19:32:34;ISABELLE\Administrateur;print;ISABELLE;;Le document 2, (Sans titre) - Bloc-notes possédé par Administrateur a été imprimé sur HP LaserJet 4L via le port LPT1:. Taille en octets : 6948 ; pages imprimées : 2 ;
WARNING;7;17-01-98 21:54:16;ISABELLE\Administrateur;print;ISABELLE;;L'imprimante HP LaserJet 4L a été remise en marche. ; WARNING;8;17-01-98 20:53:02;ISABELLE\Administrateur;print;ISABELLE;;L'imprimante HP LaserJet 4L a été vidée. ;
WARNING;6;17-01-98 20:52:37;ISABELLE\Administrateur;print;ISABELLE;;L'imprimante HP LaserJet 4L a été temporairement arrêtée. ;
This file has been generated by an unregistered version of WDumpEvt version 2.2

Dump sample in html format for the print source with messageand long format

10 | 15-02-98 18:36:12 | ISABELLE\ Administrateur | print | ISABELLE | Le document 3, Enveloppes étranger possédé par Administrateur a été imprimé sur HP LaserJet 4L via le port LPT1:. Taille en octets : 36124 ; pages imprimées : 2 | 3 | Enveloppes étranger | Administrateur | HP LaserJet 4L | LPT1: | 36124 | 2
10 | 12-02-98 21:52:26 | ISABELLE\ Administrateur | print | ISABELLE | Le document 2, liste par auteurs (verifies) possédé par Administrateur a été imprimé sur HP LaserJet 4L via le port LPT1:. Taille en octets : 404182 ; pages imprimées : 4 | 2 | liste par auteurs (verifies) | Administrateur | HP LaserJet 4L | LPT1: | 404182 | 4
10 | 10-02-98 19:32:34 | ISABELLE\ Administrateur | print | ISABELLE | Le document 2, (Sans titre) - Bloc-notes possédé par Administrateur a été imprimé sur HP LaserJet 4L via le port LPT1:. Taille en octets : 6948 ; pages imprimées : 2 | 2 | (Sans titre) - Bloc-notes | Administrateur | HP LaserJet 4L | LPT1: | 6948 | 2
7 | 17-01-98 21:54:16 | ISABELLE\ Administrateur | print | ISABELLE | L'imprimante HP LaserJet 4L a été remise en marche. | HP LaserJet 4L |  |  |  |  |  |
8 | 17-01-98 20:53:02 | ISABELLE\ Administrateur | print | ISABELLE | L'imprimante HP LaserJet 4L a été vidée. | HP LaserJet 4L |  |  |  |  |  |
6 | 17-01-98 20:52:37 | ISABELLE\ Administrateur | print | ISABELLE | L'imprimante HP LaserJet 4L a été temporairement arrêtée. | HP LaserJet 4L |  |  |  |  |  |
This file has been generated by an unregistered version of WDumpEvt version 2.2


WDumpEvt: Schedule

How to schedule an action

  1. Verify that the service is started. If not, you must install and start it.

    You can define your actions even if the service is not installed, but they will not be executed until the service is started.

  2. Choose the object (eventlog, source or category) you want to be the object of the action then open the schedule window:
    • With the Action menu
    • With the toolbar:
    • With the context menu that you obtain with the right button of the mouse when selecting an eventlog, a source or a category.

With the name control, you can load an existing action, or create a new one. If you choose an existing one, its characteristics are loaded. By changing the name of this action, you create a new one with the same characteristics when you click on the Add/Modify button.

Some particular fields

Period

To define when the action will be executed, you must first choose the periodicity:

  • Once: choose the day of the week, (nothing for today), and the hour
  • Periodically: choose the period, meaning the time between two actions.
  • Daily: choose the hour
  • Weekly: choose the day of the week and the hour. You can choose several days.
  • Monthly: choose the day of the month and the hour.

Type of action

And then you choose an action:

  • You can only choose the save and/or erase or the dump and erase for the eventlog tasks, not for a source or category actions.
  • If you save your log, you must specify the name and path of the file (don't forget that the save or dump is done only if the file specified doesn't exist).
  • If you define a dump, you must click on the property button to set the characteristics of the dump. See How to dump for more explanations.

File name

When you specify the name of the file, you can use

  • %computer% to insert the name of the computer
  • %date% or %date(format)% to insert the date of the action in the name of the file.
    The format of the date is either the one that is defined in the options, or the one that you define between the brackets with the advanced date format.

If you schedule an action for a remote computer, the path of the file is referenced for th remote computer, in other words if you specified from computer A to save the eventlog of computer B in c:/save/appli.evt, the file appli.evt will be saved on computer B if the c:/save directory exists.

Post command

The post command will be run after the execution of the action, for example send a mail thanks to the blat utility.

You can use:

  • %computer% to insert the name of the computer,
  • %date% the date of the action,
  • %file% the name of the file,
  • %action% the name of the action and
  • %result% the result of the action.

Action name

The name of the action is referenced for an object (log, source or category), so you can have the same name for different objects.

Save and load an action

You can save the action data in a file (suffix .act) with the command Save of the File menu for later loading in an other object (command Load of the File menu).

If you use the command Load action of the context menu for a server object or drag and drop an .act file, the action is loaded for the same object (log, source or category) as the original, whereas if you use load it in the schedule window, the data are loaded for the current object.

You can also view the definition of the action as well as load or print it thanks to the context menu of an .act file in the Windows explorer.

Execution immediately

To test your actions, you could send the order to the service to execute it immediately thanks to the command Execute now of the action menu. If the service is not started, the order is not saved and you must launch it again after starting the service.

List of the actions

You can get the list of actions by clicking on the [image] button on the toolbar to have the actions that remain to execute today or the [image] button to have all the actions.

  • The icon tells you if the last action is successful or not. For more details, you can look at the application log or open the schedule window command Last execution of the action menu and you obtain:
    • Date of the last execution. (with the service or with execute now)
    • Status of the action: OK if it is correct, otherwise the reason of the failure.
    • Name of the generated file.
  • The * in the seventh column means that the task will be executed today.
  • The periods are: O for once, P for periodic, D for daily, W for Weekly and M for Monthly.
  • The days are: Mon, Tue, Wed, Thu, Fri, Sat and Sun.
  • The actions are: D for dump, D/E for dump and erase, S for save, E for Erase and S/E for save and erase.

You can modify an action by clicking on the first column. You open the schedule window.

The status of the action is updated each 10 s., which explains why a selected action sometimes can loose the focus

An action is executed if the actual day corresponding to the day of the task, and if the time of the task is passed over. Correspondingly, if the is started, all the actions overdue are executed immediately.

You can see the date of the last execution in this window or check the execution of the task in the application eventlog.

You can sort the column by clicking the header of the column. The order is logical, which means:

  • For the hour column: time order.
  • For the periodicity column: the order is Once, Periodically, Daily, Weekly and Monthly.
  • For the day column: there is a periodicity sort and then a date sort (with Monday the first day of the week).
  • For the action column: the sort is save, erase save/erase, dump and dump/erase.
  • For the Last execution column: date order.
  • For the other column: alphabetic order.


WDumpEvt: service management

How to install and manage the service

You can access the service management

  • By clicking the [image] button of the toolbar.
  • By the context menu of a station object to have the state of the service for the selected station.
  • By the context menu of the tray icon to have it for the local computer.

Before using the service, you must install it first:

  1. Access the service management on a specific station or server:
  2. Then click on Install:

    Don't forget to specify the type of starting:

    • Automatic (the service starts automatically on each reboot)
    • Manual (allow the startup manually)
    • None (prevent the startup)

    You could now choose the logon user account for the LogSched service. The default is the local system account, but if you want to access to remote resources, you should use a domain system account. You must specify the account with the format: DOMAIN\ACCOUNT. To start the service, the account must have the right Log on as a service.

    • To add it to this user on Windows NT 4, you must open the user manager for the remote computer, Policies menu, choice User Rights. Check Show Advanced Users Rights, Select the right Log on as a service and add the user.

    • To add it to this user on Windows 2000, You must launch the tool Local Security Policy (control panel -> Administrative Tools), and choose Local policies -> user rights and add the user to the right Log on as a service.

    If you install the service on a remote computer, you must copy the executable service file LogSched.exe to the remote computer by clicking the Copy executable in directory checkbox. If you install the service on the local station, you can choose to keep the executable on the WDumpEvt directory or to copy it to the system directory.

    Important

    If you have loaded the additional dll (MFC42.dll...) on your computer, you also need these files for the service.
    In this case, I give you the advice that you'd better install the service in it own directory or the one of WDumpEvt to avoid conflict with your system dll.

  3. And at last you must start the service via the same window, or via the service manager of the system.

Note

You can check the state of the service at the top of this windows, or with the service management, the name of the service is: Eventlog Scheduler
When you change the state of the service, it might take a little time, especially if you stop the service during an action. The service will end the action before stopping.

Uninstall the service

Before uninstalling the service, you must stop it first.

When you uninstall the service, you may choose to keep the executable or not. It is better to erase the file if you have copied it into the system directory, but not to erase it if you keep it in the WDumpEvt directory.

You can only delete the service executable if the event viewer is not open on the application log because it uses this file to decode the event description.

Don't forget to uninstall the service before uninstalling the WDumpEvt software, because Windows NT has no procedure to uninstall a service!

Note

For each of these operations, an event is written in the application eventlog.


WDumpEvt : Description of the objects

Description of the objects

Local computer
Eventlog
Source
Category.
Computer with Windows NT or Windows 2000
Computer without Windows NT or Windows 2000
File
user sessions
failure sessions
print jobs
Ras sessions (remote access session)


WDumpEvt: Station Management

Computer

The actions are different according the type of computer.
For Windows NT and Windows 2000 computers, you can

  • See the actions still to be executed today.
  • See all the actions
  • Manage the LogSched service.
  • See the computer properties: the network comment of the computer (set with the net config server or net config workstation)

For others computers, you can only have the properties.


WDumpEvt: Eventlog management

Eventlog

If you select an eventlog, you can:

  • Save it.
  • Erase it: this action is irreversible.
  • Save and erase it.
  • Dump it.
  • Define an action.
  • Display or refresh the events list.
  • Get properties and set the maximum size and the wrapping of the log (You can only change the size and the retention if you are an administrator).

Some particular properties:

  • Number of the first event: If this number is not 1, that means that the oldest events have been automatically erased by the system.
  • The date of the last erase/save/dump is the date of the last successful actions that has been made with the WDumpEvt tool, or the LogSched service.
  • Wrapping: It define what Windows NT should do when the eventlog is full between this three choices:
    • Overwrite Events as Needed.
      When selected, ensures that all new events are written to the log, even when the log is full. Each new event then replaces the oldest event.
      This option is the best choice for ease of maintenance and is the default.
    • Overwrite Events Older than x Days.
      When selected, retains a log for a specific number of days before overwriting it. You can set the number of days before a log can be overwritten, using numbers from 1 to 365.
      The default setting for this option is 7 days. This is the best choice if you want to archive log files weekly.
    • Do Not Overwrite Events.
      When selected, retains all existing events when the log is full.
      This option requires that you manually clear the log. Click this option only if you must retain all events


WDumpEvt: Source and category management

Source and category

If you select a source or a category, you can:

  • Dump it.
  • Schedule it.
  • Display or refresh the events list.
  • Get properties.

Some particular properties

  • Date of the last dump: it is the date of the last successful dump that has been made with the WDumpEvt tool or the LogSched service


WDumpEvt: File management

File

Before to study a file, you must import it in the software

  • By the add command of the file menu.
  • By the icon. add icon of the toolbar.
  • Drag and drop of the file.

If you select a file, you can:

  • Dump it
  • Change the type of log for the file:

    The type of the eventlog is resolved by default with the first and last event. It might be wrong, it is just an indication. (It is the reason of the question mark). It is the reason why you can change it.

    The file type decides which sessions could be listed from this file as RAS sessions or print job for the system log. It decides too how to decode the event description. If you choose a wrong type, you could have no description for your events.

  • Display or refresh the events list
  • Get properties: type of the log and from which computer, date and number of the first and last event.

    • You can also have this information with the context menu of the Windows explorer of an evt file, Detail Choice.


WDumpEvt: sessions managements

User sessions
Failure sessions
RAS sessions
Print jobs

If you select a sessions, you can:

  • Dump it
  • Define an action
  • Display or refresh the events list
  • Get properties:

Some particular properties

  • Date of the last dump: it is the date of the last successful dump that has been made with the WDumpEvt tool or the LogSched service


WDumpEvt: Options

Options

You can defined

  • The language of the interface (English or French) with the options menu
  • The different format for the dump or print with the format choice of the options menu or with the [image] button of the toolbar:
    • Format of the date for the dump file and for the name of the file
    • The separator and the tags for the type of event in the text format dump
    • The header/footer and the pictures/tags for the type of event in the html format dump
    • The margins and the font of the printing

Option: date format

The date format for dump is also used for the date in the properties windows: the format used is the one at the moment of the action.

Description of the advanced format:

  • %a Abbreviated weekday name
  • %A Full weekday name
  • %b Abbreviated month name
  • %B Full month name
  • %d Day of month as decimal number (01 – 31)
  • %H Hour in 24-hour format (00 – 23)
  • %I Hour in 12-hour format (01 – 12)
  • %j Day of year as decimal number (001 – 366)
  • %m Month as decimal number (01 – 12)
  • %M Minute as decimal number (00 – 59)
  • %S Second as decimal number (00 – 59)
  • %U Week of year as decimal number, with Sunday as first day of week (00 – 53)
  • %w Weekday as decimal number (0 – 6; Sunday is 0)
  • %W Week of year as decimal number, with Monday as first day of week (00 – 53)
  • %y Year without century, as decimal number (00 – 99)
  • %Y Year with century, as decimal number
  • %% Percent sign

Note for the programmers

The advanced format is the same that the Format method of the COleDateTime class.

Option: Text format

The separator is the character used to separate the fields in the dump. The semicolon is a good separator if you want to import your dump file into a database.

You can define the strings that appear in your dump to specify the event type. For example SA instead of Success audit.

Option: HTML format

You can define the header and the footer of the HTML file. You must follow the HTML file syntax, and don't forget to close all the open tags.

Don't forget the <TABLE> and </TABLE> in the header and footer, otherwise your html file will not be correct, because the lines are defined as lines of an HTML array.

You can remove the IMG tag in the description for type fields, if you choose a word as in the txt format.

The description for type is inserted without modification in the html file, so you must pay attention to the real path of the file otherwise you will heva a blank image.

Option: Print Format

You can choose the size and the font for the print of your list.


WDumpEvt: Additional tools

Additional tools
(Command line)

These tools are only available for registered users.

CDumpEvt

Dump of eventlog.

Syntax

CDumpEvt /App|/Sys|/Sec [options] filename
/App, /Sys or /Sec | Specify the log to dump
/Since | Since last dump
/Overwrite | Overwrite an existing file
/Add | Add to an existing file
/Message | Decode the message of the event
/long | Long format
/Ole | Date format Ole
/Title | Title
/Ascii | Format ascii for the data
/Hexa | Format hexa for the data
/Evt num | Dump of only the evt with number 'num'
/TypeAuditFailure | Choose the type of event you want to dump. You can choose none, one or several types.
/TypeAuditSuccess
/TypeError
/TypeWarning
/TypeInfo
/Yes | No confirmation before dump

CDumpSession

Dump of user sessions, failure sessions, RAS sessions or print jobs

Syntax

CDumpSession /User|/Failure|/Ras|/Print [options] filename
/User, /Failure, /Ras or /Print | Specify the session to dump
/Since | Since last dump
/Overwrite | Overwrite an existing file
/Add | Add to an existing file
/long | Long format
/Ole | Date format Ole
/Title | Title
/Yes | No confirmation before dump

CSavEraLog

Save and/or erase of the eventlog.

Syntax

CSavEraLog /Save|/Erase /App|/Sys|/Sec filename
/Save and/or /Erase | Specify the action to do (save or erase or both)
/App, /Sys or /Sec | Specify the log to dump
/Yes | No confirmation before save/erase.


WDumpEvt: Some interesting events

Some interesting event

System eventlog
Print event

10 | Document was printed on.
11 | Document was paused on.
12 | Document was resumed on.
13 | Document was deleted on.
18 | Document was timed out on.

Security eventlog
Windows NT starting up/down

512 | Windows NT is starting up
513 | Windows NT is shutting down. All logon sessions will be terminated by this shutdown.

Logon

529 | Logon Failure, Reason: Unknown user name or bad password.
530 | Logon Failure, Reason: Account logon time restriction violation.
531 | Logon Failure, Reason: Account currently disabled.
532 | Logon Failure, Reason: The specified user account has expired.
533 | Logon Failure, Reason: User not allowed to logon at this computer.
535 | Logon Failure, Reason: User not allowed to logon at this computer.
536 | Logon Failure, Reason: The NetLogon component is not active.
537 | Logon Failure, Reason: An unexpected error occurred during logon.
538 | User Logoff.

Process

560 | Object Open.
562 | Handle Closed.
576 | Special privileges assigned to new logon
592 | A new process has been created.
539 | A process has exited.
594 | A handle to an object has been duplicated.


WDumpEvt: Registration

Registration of WDumpEvt

License Agreement

WDumpEvt software is Copyright © 1997-1999, Isabelle Vollant.
All rights for this software are reserved by the author.
You are not allowed to modify or reverse engineer the contents of the program files.

WDumpEvt is Shareware. That means you can use it free of charge only for 30 days evaluation period. After that, you must either register your copy product by paying a license fee to the author, or stop using it.
Besides legalizing your usage of WDumpEvt, there're several other reasons to register WDumpEvt. Please, see Registration section for more info.

Regardless of your registration status, you're encouraged to distribute unregistered version of WDumpEvt. Registered version cannot be distributed at all.

This software cannot be resold or used in any profit-generating activities, including, but not limited to, distributing WDumpEvt as part of commercial products, or in support of commercial services, without the authors expressed written permission.

There is no warranty or claim of fitness or reliability. The program is distributed AS IS, and the author shall not be held liable for any loss of data, down time, loss of revenue or any other direct or indirect damage or claims caused by this software.

Registration

As defined in WDumpEvt license, you must register the product to continue using it after the 30-days evaluation period is over. Registration involves paying a fee of:

$50 | FF 250 | 40 euros | For the main program and the service on the same computer. and LogSched on 2 extra computers
$70 | FF 350 | 56 euros | For the main program and 5 LogSched
$100 | FF 500 | 80 euros | For the main program and 10 LogSched
$10 | FF 50 | 8 euros | For each extra computer that you install the LogSched service.
$90 | FF 450 | 72 euros | 10 LogSched
$200 | FF 1000 | 160 euros | 25 LogSched
$360 | FF 1800 | 288 euros | 50 LogSched
$600 | FF 3000 | 480 euros | 100 LogSched

Contact me for site license pricing.

Here's what you get for your money, when you register:

  • Three additional tools usable on command lines are distribute to registered users:
    CDumpEvt | Dump of eventlog.
    CDumpSession | Dump of users sessions, failure sessions, RAS sessions and print jobs.
    CSavEraLog | Save and erase of the eventlog.
  • Technical support. Provided through e-mail. I'll answer any question about. I'll do my best to solve (or help you to solve) any problems you might have in conjunction with the product.
  • Registration code to stop generating warning message in the application eventlog, and to suppress the sentence at the end of the dump file.

HOW TO REGISTER

You can order on Internet with credit card

Or send the form with a check to

Isabelle VOLLANT
17 place Lucien Bossoutrot
78140 Vélizy-Villacoublay
France

email: info@eventlog.com
Tel: (33) (1) 39 46 27 95


Registration of WDumpEvt

Registration form

You can order with credit card

Or send a check to

Isabelle VOLLANT
17 place Lucien Bossoutrot
78140 Vélizy-Villacoublay
France

Date:
Name:
Company
Adress1:
Adress2:
City: | State/Province:
Country: | Zip/PC:
Email:

Licences
US$ | FF | euros
Pack 1: 1 WDumpEvt and 2 LogSched | $50 | FF 250 | 40 euros
Pack 2: 1 WDumpEvt and 5 LogSched | $70 | FF 350 | 56 euros
Pack 3: 1 WDumpEvt and 10 LogSched | $100 | FF 500 | 80 euros
Pack 4: 1 LogSched | $10 | FF 50 | 8 euros
Pack 5: 10 LogSched | $90 | FF 450 | 72 euros
Pack 6: 25 LogSched | $200 | FF 1000 | 160 euros
Pack 7: 50 LogSched | $360 | FF 1800 | 288 euros
Pack 8: 100 LogSched | $600 | FF 3000 | 480 euros
Total

Signature

Comment or suggestions


WDumpEvt: Acknowledgments

Acknowledgments

I want to thank

  • my parent Jean Claude and Monique to help me with the documentation and the screen capture.
  • my brother Gilles (winimage author) to technical support and advices.
  • Peder Wiese to rereads and corrects my poor english.
  • The users who supported the development of this software by registering and recommending it to their friends and colleagues
  • The users who send me their log.
  • The users who have contributed by communicating problems and suggestions.


.topic 1000
Dialog box where you can select a user account the service LogSched will use to log on.

The account number must be of the format domain\account

.topic 1001
Shows the startup type for a service:

    Automatic 	: Specifies that the service should start automatically when the system starts.

    Manuel 		: Specifies that a user or a dependent service can start the service. Services with Manual startup do not start automatically when the system starts.

    Disabled		: Prevents the service from starting by the system, a user, or any dependent service.

.topic 1002
Show the path and the location of the original file of the service.

You can 	either execute the service from this location,

        or copy it (preferably in a system directory) before starting.

.topic 1003
Show the path and the name of the copy of the file.

The name and the location of this file cannot be modified until you uninstall this service.

.topic 1005
Defines if you have to copy the executable file of the service before executes it or not.

You have to specify the destination directory

.topic 1006
Specifies that the service will log on using the system account, rather than a user account.

.topic 1007
Provides places for you to type and confirm the password for the user account.

This is the password that was assigned to the user account in Local Users and Groups.

.topic 1008
Assigns a logon account to the LogSched service so  that the user can have access to resources such as remote files and folders .

.topic 1009
Click here to select the directory where to copy the service.

.topic 1100
Server where the action will be executed.

.topic 1101
Name of the log where the action will be executed.

.topic 1102
Identifies the software that logged the event.

The software can be either an application or a component of the system, such as a driver.

.topic 1103
Specifies an event category, as defined by the program logging the event.

.topic 1104
Name of the destination file.

.topic 1516
Save the log.

Only available for an eventlog.

.topic 1520
Dump then erase the log.

Only available for an eventlog

.topic 1106
For a periodic action, interval between two events.

For the other, time of the execution of the action.

.topic 1107
days of the execution

.topic 1314
output format :

    Title		: Add a title at the beginning of the file.

    Message	: Add the description of the event.

    Format long or personal format (for the session dump)

    Date OLE	: Date in format OLE, i.e. a real.

               (This format is useful if you want to import a file to MS-Access, for instance.)

    Data hexa	: Data in hexadecimal form.

    Data ASCII	: Data in ASCII form.

.topic 1110
output format :

    Title		: Add a title at the beginning of the file.

    Message	: Add the description of the event.

    Format long or personal format (for the session dump)

    Date OLE	: Date in format OLE, i.e. a real.

               (This format is useful if you want to import a file to MS-Access, for instance.)

    Data hexa	: Data in hexadecimal form.

    Data ASCII	: Data in ASCII form.

    All events or only one (identified by its number)

    Since the last dump , i.e. since the last execution of this action.

    Add to an existing file or rewrite an existing file.

    All the types or one or more types among :

        Error

        Warning

        Information

        Success Audit

        Failure Audit

.topic 1111
Periodicity of the action among:

    Once

    Periodically

    Daily

    Weekly

    Monthly

.topic 1105
Action to do among:

    Save

    Erase

    Save and erase

    Dump

    Dump and erase

.topic 1200
List of available fields.

.topic 1201
List of fields included in the dump.

.topic 1202
Add one or more fields into the dump.

.topic 1203
Suppress one or more fields into the dump.

.topic 1204
Change the order of fields in the dump. The selected field is set before the preceding one

.topic 1205
Change the order of fields in the dump. The selected field is set after the following one

.topic 1206
Modify the title of the field. Don't forget to validate to take in account the modification.

.topic 1207
Validate the modification of the title.

.topic 1300
Display the type of the action and the object that is concerned.

.topic 1301
Click for searching a file.

.topic 1302
Add a title at the top of the file.

This option is only available for the short format.

.topic 2305
Ajoute un titre au debut du fichier.

.topic 1303
Add the description of the event.

.topic 1304
If this option is not selected, the dump is in short format:

    number of the event

    type of the event

    name of the computer

    date and time

    name of the user

    domain

If not, the dump is in long format:

    short format extended with specific information of the event.

.topic 1305
Date in format OLE, i.e. a real.

This format is useful if you want to import a file to MS-Access, for instance.

.topic 1306
Data in hexadecimal form.

.topic 1307
Data in ASCII form.

.topic 1309
Name of the output file:

Its extension (TXT,HTM/HTML or CSV) settles the type of the file.

You can use

    %computer%			: to add the name of the computer

    %date% or %date(format)%	: to insert the date. The format is the same as this of the options.

.topic 1310
If this option is not selected, you must specify the number of the event to dump.

.topic 1311
The last dump is :

    for an action, 		: the last execution of this action,

    for a direct dump, 	: the last dump of this object (log, source, category)

.topic 1313
Number of the event to dump

.topic 1315
Display the type of log the file is a backup. If this type seems to be not correct, you can change it.

If this type is not correct, the description of the events will be incorrect or ignored.

.topic 1316
Display if the binary data of the event will be dumped or not and with what format.

Every event doesn't generate binary data.

.topic 1317
Click  here to have a glance of this dialog box.

To obtain some help on a specific .topic, click on the question mark of this .topic.

.topic 1319
Dump every event types.

.topic 1320
Select one or more event types for dumping.

    Error

    Warning

    Information

    Success Audit

    Failure Audit

.topic 1321
Add the dump at the end of the existing file, or create the file if it doesn't exist.

Caution if you use HTML format, heading and foot page will be also added.

.topic 1322
Test the name of the file with the current date.

.topic 1323
Replace the existing file by the dump file, or create it if it doesn't exist.

.topic 1400
Name supplied when you register.

.topic 1401
Code supplied when you register.

.topic 1500
Display the frequency of the action.

.topic 1501
The action will be executed only once.

You have to specify for the action the time and optionally a day in the week.

.topic 1502
The action will be executed periodically.

You have to specify the time between each dump.

.topic 1503
The action will be executed each day.

You have to specify the time of the execution.

.topic 1504
The action will be executed each week, one or more Time.

You have to specify one or more days plus the time of execution.

.topic 1505
The action will be executed each month.

You have to specify the day in the month plus the time of execution.

.topic 1506
Name of the action.

The rolling menu displays the actions already defined for the selected object.

Il you choose one of these actions, its definition will be loaded.

The renaming of this action allows you to do one copy.

.topic 1507
Display the starting time of the action.

.topic 1510
Selection of the day(s) of the weekly action.

.topic 1511
Selection of the day(s) of the weekly action.

.topic 1512
Selection of the day of the monthly action.

.topic 1513
Selection of the day(s) of the weekly action.

.topic 1515
Selection of the action.

.topic 1517
Erase the log.

This action is available only for a log.

.topic 1518
Save then erase the log.

This action is available only for a log.

.topic 1519
Dump of the log, a source or category.

This action is available for a log, a source or category.

.topic 1521
Name of the file where the log will be saved.

You can use

    %computer%			: to add the name of the computer.

    %date% or %date(format)%	: to insert the date. The format is the same as this one of the action.

.topic 1523
Click to define the characteristics of the dump.

You have to define your dump before validate your action.

.topic 1524
Choice of the periodicity of the periodic actions.

.topic 1525
Choice of the periodicity of the periodic actions.

.topic 1526
Choice of the unit of the periodicity :

    minute

    hour

.topic 1527
Script to be executed after the action.

You can use

    %computer%	: to define the computer on which the action was run.

    %date%		: the execution date of the action.

    %file%		: the name of the file result of the action.

    %action%	: the name of the action

    %result%	: the result of the action

.topic 1600
Installs the service LogSched

You can specify the type of start and the place of the executables by clicking on this button.

This button is enabled only if the service is not installed, or if the state of the service is unknown.

.topic 1601
Starts the service LogSched

This button is enabled only if the service is installed, and not started or if the state of the service is unknown.

.topic 1602
Uninstalls the service LogSched

This button is enabled only if the service is installed, and not started or if the state of the service is unknown.

.topic 1603
Stops the service LogSched

This button is enabled only if the service is started or if the state of the service is unknown.

.topic 1609
Server where is installed the service.

.topic 1604
Show the path and the place of the file of this service.

The name and the location of this file cannot be modified until you uninstall this service.

.topic 1605
Name of the service

.topic 1606
Version of the service.

Must be identical to this of the main program WDumpEvt.

.topic 1607
start type txt ?????????????????????????????????????????????

.topic 1608
Shows the status of a service, as follows:

    The service is not installed

    The service is not running

    The service is starting 		: The service is starting, but has not fully started yet.

    The service is running

    The service is stopping		:  The service is stopping but has not fully stopped yet.

    Status unknown			: The service has not yet respond to the information demand.

.topic 1611
Select the startup type of the service.

.topic 1615
Display the login account that starts the service.

.topic 1900
Display the details of the previous event.

.topic 1901
Display the details of the next event.

.topic 3003
Displays the user name if an event is attributed to a specific user.

.topic 1902
Display the user name that prints the document.

.topic 1903
Print date.

.topic 1904
Size of the printed document.

.topic 1905
Pages number of the printed document.

.topic 1906
Printing port.

.topic 1907
Name of the printer server.

.topic 1908
Order number of the document.

.topic 1909
Domain and user name which generated this event.

.topic 1910
File name of the document.

.topic 1911
Name of the printer who print the document.

.topic 2002
start date of the session.

.topic 2003
User name of the session.

This name is in parenthesis if the user field of the event is empty and this is the user that generated the event.

.topic 2004
Authentication process. In general "msv1_0" or "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0":

.topic 2005
Computer of the user connection.

.topic 2006
Session type :

    2 	: Interactive session.

    3 	: Network session. (net use, net view or file manager session)

    4 	: Batch session.

    5 	: Service

    6 	: Proxy

    7 	: Unlock Workstation

.topic 2007
Identification number of the session.

.topic 2008
Open session process:

      "KSecDD":

             ksecdd.sys, the security device driver

      "User32" or "WinLogon\MSGina":

             winlogon.exe & msgina.dll, the authentication user interface

      "SCMgr":

             The Service Control Manager

      "LAN Manager Workstation Service"

      "advapi" :

           API call to LogonUser

    "IIS" :

        Internet Information Server

    NtLmSsp :

        NT LAN Manager Security Support Provider

.topic 2009
Domain name.

.topic 2010
Server name.

.topic 2011
Session duration.

.topic 2012
Date de fin de la session.

.topic 2013
Domain and user name which generated this event.

.topic 2102
User name of the session.

.topic 2109
Date of the connection attempt.

.topic 2111
Reason of the session failure.

It id the description of the event, the reason is at the beginning.

.topic 2202
Date of the session start.

.topic 2203
User name of the session.

.topic 2204
Event date.

.topic 2205
Bytes sent during the session.

.topic 2206
Bytes received during the session.

.topic 2207
Name of the connection port.

.topic 2208
domain name of the user.

.topic 2209
Server name.

.topic 2210
Session duration.

.topic 2211
Date of the end of the session.

.topic 2212
Domain and user name which generated this event.

.topic 2213
Connection speed.

.topic 2214
Reason of the session disconnection.

.topic 2308
Open the Dialog box where you can choose the dump fields.

.topic 2309
Short format. The fields' list depends of the session type. For more details, see the help file.

.topic 2310
Long format , i.e. all the fields.

.topic 2311
Customized format. You can choose the dump fields thanks to the Customize button.

.topic 2400
Events number of the log.

.topic 2401
Displays the name and location of the log file.

.topic 2402
Displays the current size of the log file.

.topic 2403
Display the date of the first event of the log.

.topic 2404
Display the date of the last event of the log.

.topic 2405
Display the date of the last erase made with WDumpEvt or LogSched service.

.topic 2406
Display the date of the last save made with WDumpEvt or LogSched service.

.topic 2407
Display the date of the last dump made with WDumpEvt or LogSched service.

.topic 2408
Number of the first event of the log.

If this number is different from 1, that means that the older events have been automatically erased by the system.

.topic 2409
Number of the last event of the log.

.topic 2410
Show the number of the first and last event of the last dump made with WDumpEvt or LogSched service .

.topic 2412
Specifies the action taken when the maximum log size is reached.

.topic 2411
Provides a space for you to enter the maximum log file size. Or click the arrows to change the log file size.

The default maximum size is 512K.

The overwrite options below this tab specify what happens when this limit is reached.

.topic 2413
Specifies whether all new events will be written to the log, even when the log is full.

When the log is full, each new event replaces the oldest event.

.topic 2414
Specifies the number of days a log file will be retained before writing over it.

You can set the number of days before a log can be overwritten, using numbers from 1 to 365. New events will not be added if the maximum log size  is reached and there are no events older than this period.

The default setting for this option is 7 days. This is the best choice if you want to archive log files weekly.

.topic 2415
Specifies whether existing events will be retained when the log is full. If the maximum log size is reached, new events are discarded.

This option requires that you manually clear the log.

Select this option only if you must retain all events.

.topic 2416
Set how the events are retained when the maximum log size is reached.

.topic 2419
Save the modification without closing the dialog box.

.topic 2420
Restore default settings for the eventlog.

.topic 2502
Server name to be added to the tree  (with or without //)

.topic 2501
If you check this box, the server will be automatically added each time you start WDumpEvt.

.topic 2600
Date format for the dump data.

.topic 2601
Date format for the file name.

.topic 2602
Format test with the current date.

.topic 2603
The advanced format is the same that the Format method of the COleDateTime class.

    %a 	: Abbreviated weekday name

    %A 	: Full weekday name

    %b 	: Abbreviated month name

    %B 	: Full month name

    %d 	: Day of month as decimal number (01 - 31)

    %H 	: Hour in 24-hour format (00 - 23)

    %I 	: Hour in 12-hour format (01 - 12)

    %j 	: Day of year as decimal number (001 - 366)

    %m 	: Month as decimal number (01 - 12)

    %M 	: Minute as decimal number (00 - 59)

    %S 	: Second as decimal number (00 - 59)

    %U 	: Week of year as decimal number, with Sunday as first day of week (00 - 53)

    %w 	: Weekday as decimal number (0 - 6; Sunday is 0)

    %W 	: Week of year as decimal number, with Monday as first day of week (00 - 53)

    %y 	: Year without century, as decimal number (00 - 99)

    %Y 	: Year with century, as decimal number

    %%	: Percent sign

.topic 2607
Format test with the current date.

.topic 2700
Character use to separate the fields in the dump.

the semicolon is a judicious separator if you want to import the file in a database.

.topic 2701
Set the string that appears in your dump to specify the event type.

.topic 2800
Set the header of the HTML file.

You must follow the HTML syntax for a header HTML file and don't forget the <TABLE> tag, the data of the dump are insert into an HTML array.

.topic 2801
Set the footer of the HTML file.

You must follow the HTML syntax for a footer HTML file and close all the tag that you open in the header and don't forget the </TABLE> tag.

.topic 2802
Set the string that appears in your dump to specify the event type.

You can define this string in HTML and then insert images. Caution, you must specify the path of the image file from the HTML file.

.topic 2900
Set margin settings. The print will take place only inside these margin.

.topic 2901
Font name for the print of the dump.

.topic 2902
Size of the character for the print of the dump.

.topic 2903
Change the size and font for the print of the dump.

.topic 3002
Displays the date the event was generated.

.topic 3007
Displays a text description of the event. Text descriptors are created by the source of the event.

If the word (local) is added at the end of the description of an remote computer event, that's means  that the description is decoded on the local computer instead of the remote one.

.topic 3103
Displays binary data generated by the event. Not all events generate binary data

.topic 3104
Display the parameters of the event

i.e. the specific data that complete the event description.

.topic 3008
Order number of the event in the log.

.topic 3010
Displays an event number to identify the specific event.

.topic 3009
Display the computer name where occurs the registered event.

.topic 3100
Displays binary data generated by the event in hexadecimal (Bytes)

.topic 3101
Displays binary data generated by the event in DWORDS (Words) format

.topic 3102
Displays binary data generated by the event in ASCII format (useful for Dr Watson event)