Eventlog Syntax issue

Dec 2, 2008
224
2
Canada
I am using version 13.04:

Command "EVENLOG" show the following syntax in the manual:

EVENTLOG [S"source" /Cn /E /I /W] message

this syntax works but when using the /= option the following syntax is generated:

EVENTLOG [/S"source" /Cn /E /I /W] message

and this doesn't work.

Craig Gunhouse
 
May 20, 2008
11,400
99
Syracuse, NY, USA
From the command line,
Code:
eventlog /s"testsource" /c7 /i foo
(as expected) gives an event with source "testsource" and message "foo. This
Code:
eventlog s"testsource" /c7 /i foo
gives an event with source "TCC.EXE" and message "s"testsource" /c7 /i foo" (that would also seem to be as expected).
The problem with the /= dialog is that it doesn't put the "/Ssource" first, where the help says it must be, even of it's the first thing you enter in the dialog. It puts the category first. Below, I entered the source before I entered the category, and recalled the command after it failed.
Code:
v:\> eventlog /=
TCC: (Sys) The parameter is incorrect.
"Stestsource4"
Usage : EVENTLOG [/Ssource] [/Cn /EIW] message
 
v:\> EVENTLOG /C666 /Stestsource4 foo
 
May 20, 2008
11,400
99
Syracuse, NY, USA
And the error message I get when I use EVENTLOG not elevated is odd:
Code:
v:\> eventlog /s"testsource" /c666 /i foo
TCC: (Sys) The operation completed successfully.
 
May 20, 2008
11,400
99
Syracuse, NY, USA
And the error message I get when I use EVENTLOG not elevated is odd:
Code:
v:\> eventlog /s"testsource" /c666 /i foo
TCC: (Sys) The operation completed successfully.
And I don't understand why EVENTLOG should fail at all for me, an admin, not elevated, under UAC. Under those circumstances, this feeble attempt results in an event log entry (with the expected "source cannot be found" caveat).
Code:
    HANDLE hEventLog = OpenEventLog(NULL, L"Application");
    if ( hEventLog == NULL )
        Error(L"OpenEventLog()", GetLastError());
    HANDLE hEventSource = RegisterEventSource(NULL, L"NoExist");
    if ( hEventSource == NULL )
        Error(L"RegisterEventSource()", GetLastError());
    LPCWSTR szMessage = L"foo";
    if ( !ReportEvent(hEventSource, EVENTLOG_SUCCESS, 888, 666, NULL, 1, 0, &szMessage, NULL) )
        Error(L"ReportEvent()", GetLastError());
 

rconn

Administrator
Staff member
May 14, 2008
12,344
149
And I don't understand why EVENTLOG should fail at all for me, an admin, not elevated, under UAC. Under those circumstances, this feeble attempt results in an event log entry (with the expected "source cannot be found" caveat).

You're not creating the event source (in the HKLM registry tree), which is where the elevation is required.
 
May 20, 2008
11,400
99
Syracuse, NY, USA
You're not creating the event source (in the HKLM registry tree), which is where the elevation is required.
Yeah, I figured that out after remembering how it all works.

There's a small error in the help. It says the category may be 0-999999. But it's a WORD and indeed, 65536 results in 0, 65537 results in 1.
 
Dec 2, 2008
224
2
Canada
Sorry after more testing, it appears to be the placement of the "/S" option:

[C:\Program Files\JPSoft\TCMD13x64]EVENTLOG /S"TEST" /E /C1 TEST
TCC: (Sys) The operation completed successfully.

[C:\Program Files\JPSoft\TCMD13x64]EVENTLOG /E /C1 /S"TEST" TEST
TCC: (Sys) The parameter is incorrect.
"S"TEST""
Usage : EVENTLOG [/Ssource] [/Cn /EIW] message

And EVENTLOG /= generates syntax similar to the second fail syntax.

Craig
 
Similar threads
Thread starter Title Forum Replies Date
GermanDirk How to? EVENTLOG Command with simple User Rights not functional Support 4
David McClelland eventlog options are positional Support 2
C Syslog/eventlog Support 1
M syntax for sftp with publickey Support 3
vefatica IDE external command syntax color? Support 1
Joe Caverly Command Input Syntax Colouring Support 3
C Nested IF syntax — TCC behaving differently to CMD Support 12
rps Documentation Regular expression syntax link broken Support 1
Dan Glynhampton Documentation v15 help: Syntax error in example of @DEC Support 0
D Syntax error when redirecting eval Support 5
C @diskfree[ ] syntax in 15.00.17 Support 0
T Syntax highlighting in the IDE Support 8
krischik Stop Script after Syntax Error. Support 6
J syntax problems multiple commands (command & command) Support 4
C CMD's "nested quote" syntax Support 3
T TCTOOLBAR syntax Support 0
S Status line syntax help Support 2
H Double prompt for password with * in FTP syntax Support 3
dcantor FFIND syntax -- is /E"regex" /X supported? Support 2
C extended DIR syntax? Support 7
J Problem with %var:find=replace% syntax Support 5
A syntax colouring Support 0
dcantor Syntax files, and suggestion Support 0
J Problem with peculiar CMD syntax Support 2
G v28 Display Issue Support 7
Jay Sage Issue with CD_ENTER Alias Support 37
Jay Sage Issue with CD_LEAVE Alias Support 3
fpefpe How to? issue with % and evaluation Support 5
cgunhouse Standard User Account Issue Support 2
samintz WAD Display wrapping issue Support 5
M TCC color issue in ConEmu Support 4
samintz Timer issue Support 4
Alpengreis Documentation Minor issue in help file for view /E Support 1
samintz WAD ANSI issue Support 3
D TCSTART issue after reinstallation Support 14
A Documentation [Help file] OPTION "//" synopsis formatting issue Support 0
Chen Touboul Overtyping issue - i press the Insert key, help till press enter for new line in TCC Support 2
Y TCC and Cmder imcompatibility issue Support 7
M Another possibly strange remote registry issue Support 5
T WAD bpokestr issue Support 5
D High-DPI Scaling issue Support 1
S CMDebug 22 issue with del command Support 1
cgunhouse Foldermonitor Issue Support 7
samintz Build 38 Install issue Support 5
rps WAD Setlocal issue Support 4
Luiz Rodrigues Issue with Maven Support 1
Seven Update / install issue with 20.0.20.10.32 take command Support 7
Fross WebDav Drive Mapping Issue Support 19
D Upgrade issue Support 3
Fross V20b8 Everything Issue Support 5

Similar threads