CODEWITHSUNDEEP
pythonwmipidwmi-queryevent-viewer
Umang Agrawal
Umang Agrawal

Reputation: 515

How to retrieve PID from windows event log?

enter image description hereI have a python code that uses WMI module of python to get windows event viewer logs. But I am unable to retrieve the PID of the process that generated the log. My code :

wmi_obj = wmi.WMI('.') #Initialize WMI object and query.
wmi_query = "SELECT * FROM Win32_NTLogEvent WHERE Logfile='System' AND EventType=1"
query_result = wmi_obj.query(wmi_query) # Query WMI object

query_result is a list of wmi objects. Each object in this list is a windows system log and I want PID of the process that generated this log. I have gone through several msdn docs but couldn't find anything useful there.

I want to retrieve the information marked in the above image.

Upvotes: 2

Views: 8537

Answers (1)

patthoyts
patthoyts

Reputation: 33223

The Win32 API call to get event log items is ReadEventLog and this returns EVENTLOGRECORD structures. These do not have a field for a process identifier so unless your events have included this in the data of the event message it looks like this will not be available.

Upvotes: 0

Related Questions