I installed the latest Win32-EventLog the other day and can query my 
EventLog fine, but there are cases where I can see a description in the 
EventViewer, but my Ruby code gets a nil for description. I first 
noticed this while trying to pull out all the failed ssh logins that 
were reported (I've been under siege the last week or so from the ssh 
exploit script). I was able to get at those records that were from sshd, 
all of which had text like this shown in the EventViewer:

The description for Event ID ( 0 ) in Source ( sshd ) cannot be found. 
The local computer may not have the necessary registry information or 
message DLL files to display messages from a remote computer. You may be 
able to use the /AUXSOURCE= flag to retrieve this description; see Help 
and Support for details. The following information is part of the event: 
invalid login.

But Ruby shows me nil for the description. I've also seen this with 
other processes. The pattern seems to be that if the Event Id is 0, a 
message like that shows up, with the last sentence saying "in part of 
the event" and them some info that is actually useful. But with Ruby, 
all I get is nil for the description. I've briefly looked at the C 
source for this, but I'm not familiar with the EventLog code in Windows...

So, is there anything that I can do to get the description that the 
EventViewer displays instead of nil, in those cases where the Event Id 
is 0 (or the event can't be found, or whatever the problem is)? It seems 
like the EventViewer has access to something that we don't.

BTW, this is on a WindowsXP Pro sp1 system. (Actually two different 
systems.)

Joey

-- 
She drove a Plymouth Satellite
Faster than the Speed of Light...

http://www.joeygibson.com/blog
http://www.joeygibson.com/blog/life/Wisdom.html
Atlanta Ruby User Group http://www.AtlRUG.org