Jan KrƦĦŤĥger <jk / microgalaxy.net> wrote in message news:<41751280.20401 / microgalaxy.net>...
> Joey Gibson wrote:
> > Daniel Berger wrote:
> > 
> >> Is there any chance you can narrow down a particular message it's
> >> failing on?  Is it always at the same point?  Perhaps something about
> >> the quantity or formatting of the event description is causing a
> >> problem.
> >>
> > 
> > It was obviously something with one or a few of the messages in the log 
> > because once I cleared the log and then added more records, everything 
> > worked fine. I did a backup of the log, but I'm not sure what to do with 
> > it. If I can figure out what to do with it, perhaps I can investigate 
> > further...
> 
> Once upon a time there was ...
> .. Python, WinNT4, the EventLog and me.
> I just wanted to read the Eventlog with a Python app and it frequently 
> crashed. Luckily Python is OpenSource so i tried debugging it. What i 
> found out is, that the process crashed in a native WinNT function when 
> this function tried to access one special EventLog entry. This entry 
> was special because the messsage provider for this EventLog entry did 
> not exist any longer at this workstation because i deinstalled the 
> application that was meant to provide the message provider. So the 
> attributes of this entry pointed to some invalid message provider that 
> caused the function to fail. There was nothing one could do, except 
> deleting this particular entry from the eventlog. Such thing can 
> easily happen if you upgrade, downgrade or deinstall applications.
> Maybe it is related to your experience.
> 
> Well, and i am not living together with WinNT4, EventLog and Python 
> until the end of my live. But i am still happy :)
> 
> Gru
> Jan

I tested the scenario you mention, but could not duplicate the
problem.  In testing, if the eventlog source for an eventlog entry is
deleted, it seems to merely skip those.  It didn't cause a problem on
my Windows box.  Perhaps that was an NT 4 issue, or perhaps it was a
problem with older versions of the libs.

In this case, however, I've determined that it's definitely something
in the log itself.  If I try to read the backup file, it crashes on me
consistently just after record number 5458.

So, now I need to figure out what the heck is up with this particular
log entry that's causing the problem.

Regards,

Dan