From: djberg96@... (Daniel Berger)
Date: 2004-10-19T11:14:21+09:00
Subject: Re: Another Interesting "Problem" with Win32-EventLog

Joey Gibson <joey@joeygibson.com> wrote in message news:<4173E120.80106@joeygibson.com>...
> After Daniel patched the Win32-EventLog code to properly handle 
> "strange" event messages (I'll leave it to Daniel to explain that) my 
> program started working, but then dies. Here's the full text of the program:
> 
> require 'win32/eventlog'
> include Win32
> 
> log = EventLog.open("Application")
> 
> log.read do |rec|
>   puts rec.inspect if rec.source == 'sshd'
> end
> 
> I wrote this script because I've been getting thousands of infiltration 
> attempts via ssh, and I wanted to pull all the ssh messages out and do 
> "something" with them. I've been running the script thusly;
> 
> ruby el.rb > el.out
> 
> It runs for a few/several seconds then dies with this:
> 
> This application has requested the Runtime to terminate it in an unusual 
> way.
> Please contact the application's support team for more information.
> 
> The output in the redirected file is truncated when the process died. 
> I've tried outputting to a file directly instead of just going to stdout 
> and redirecting, but it does the same thing. The last run I did was a 
> few minutes ago, and the output file had 1433 complete lines (the 
> #inspect gets everything on one line) and 1 truncated line. There are 
> many more events still to be read.
> 
> Does this ring a bell with anyone?
> 
> Here are my vitals:
> 
> ruby 1.8.2 (2004-07-29) [i386-mswin32]
> WindowsXP Pro sp1
> Win32-EventLog - built from CVS on 10/14.
> 
> Joey

Hi Joey,

After getting home from work today I tried again on my home machine. 
My "System" log has over 1700 messages in it, but a test script with
no failure.  I intentionally wrote several hundred event log messages
to my application log - about 2500 in total - and I still couldn't get
it to fail.

So, my gut feeling now is that it's not the quantity of messages, but
something about one message in particular that's causing it to crash.

Is there any chance you can narrow down a particular message it's
failing on?  Is it always at the same point?  Perhaps something about
the quantity or formatting of the event description is causing a
problem.

Regards,

Dan