From: Park Heesob <phasis68@...>
Date: 2006-05-23T20:53:27+09:00
Subject: Re: win32 eventlog change_notify and tail's not tailing in order


Hi,

>From: Pe?, Botp <botp@delmonte-phil.com>
>Reply-To: ruby-talk@ruby-lang.org
>To: ruby-talk@ruby-lang.org (ruby-talk ML)
>Subject: win32 eventlog change_notify and tail's  not tailing in order
>Date: Tue, 23 May 2006 18:01:37 +0900
>
>Hi Daniel and win32 team,
>
>I noticed that if i run change_notify or tail for a few records, the 
>grabbed record and time is not in order.
>
>eg,
>
>C:\family\ruby\win-eventlog>test5.rb
>Win32::EventLog
>record_number : 19558
>time_generated : Tue May 23 16:46:33 China Standard Time 2006
>time_written : Tue May 23 16:46:33 China Standard Time 2006
>event_id : 578
>event_type : audit success
>category : 4
>---------------
>record_number : 19226
>time_generated : Tue May 23 15:52:14 China Standard Time 2006
>time_written : Tue May 23 15:52:14 China Standard Time 2006
>event_id : 600
>event_type : audit success
>category : 5
>---------------
>record_number : 18903
>time_generated : Tue May 23 14:31:17 China Standard Time 2006
>time_written : Tue May 23 14:31:17 China Standard Time 2006
>event_id : 593
>event_type : audit success
>category : 5
>---------------
>record_number : 18603
>time_generated : Tue May 23 11:52:33 China Standard Time 2006
>time_written : Tue May 23 11:52:33 China Standard Time 2006
>event_id : 578
>event_type : audit success
>category : 4
>---------------
>record_number : 18296
>time_generated : Tue May 23 11:48:31 China Standard Time 2006
>time_written : Tue May 23 11:48:31 China Standard Time 2006
>event_id : 578
>event_type : audit success
>category : 4
>---------------
>***************
>Win32::EventLog
>record_number : 19575
>time_generated : Tue May 23 16:47:02 China Standard Time 2006
>time_written : Tue May 23 16:47:02 China Standard Time 2006
>event_id : 578
>event_type : audit success
>category : 4
>---------------
>
>note the record number and time in disorder.
>The Eventlog#read works fine though and ::read outputs the normal 
>chonologic order. It's only the change_notify and tail where i get 
>problems.
>
>Btw, Is it possible to implem Eventlog#tail using Eventlog#read?
>
>Thank you and kind regards -botp
>
It is a known bug.

Refer to 
http://rubyforge.org/pipermail/win32utils-devel/2006-May/000571.html

I recommend you to wait the announcement of new win32-eventlog package 
before implement your own Eventlog#tail.

The pure ruby version of win32-eventlog package is about to release in this 
weekend.
I guess it will provide more reliable Eventlog#tail.

Regards,

Park Heesob