After Daniel patched the Win32-EventLog code to properly handle 
"strange" event messages (I'll leave it to Daniel to explain that) my 
program started working, but then dies. Here's the full text of the program:

require 'win32/eventlog'
include Win32

log = EventLog.open("Application")

log.read do |rec|
  puts rec.inspect if rec.source == 'sshd'
end

I wrote this script because I've been getting thousands of infiltration 
attempts via ssh, and I wanted to pull all the ssh messages out and do 
"something" with them. I've been running the script thusly;

ruby el.rb > el.out

It runs for a few/several seconds then dies with this:

This application has requested the Runtime to terminate it in an unusual 
way.
Please contact the application's support team for more information.

The output in the redirected file is truncated when the process died. 
I've tried outputting to a file directly instead of just going to stdout 
and redirecting, but it does the same thing. The last run I did was a 
few minutes ago, and the output file had 1433 complete lines (the 
#inspect gets everything on one line) and 1 truncated line. There are 
many more events still to be read.

Does this ring a bell with anyone?

Here are my vitals:

ruby 1.8.2 (2004-07-29) [i386-mswin32]
WindowsXP Pro sp1
Win32-EventLog - built from CVS on 10/14.

Joey



-- 
She drove a Plymouth Satellite
Faster than the Speed of Light...

http://www.joeygibson.com/blog
http://www.joeygibson.com/blog/life/Wisdom.html
Atlanta Ruby User Group http://www.AtlRUG.org