Reporting from the Windows 2000XP Event Log

Reporting from the Windows 2000/XP Event Log

As Windows 2000 and XP replace former desktop leaders Windows 95 and Windows 98, and with Windows Server 2003 beginning to take hold as one of the new server solutions of choice, reporting off these operating system logs becomes an even more important capability of Crystal Reports .

An integrated part of the original Windows NT, and its predecessors Windows 2000, XP, and Windows Server 2003, is the event log. The event logs are files that document events that occur during the general operation of Windows. Several different types of event logs are available, and different types of entries are placed in the event logs as users log on and off, and programs start, stop, and operate . Crystal Reports includes the capability to create flexible reports on these event logs.

Note  

Although designing reports against the event logs won t harm the computer containing the log, you probably won t find the information returned to be of much use if you re not generally familiar with Windows 2000/XP and its components . This Crystal Reports capability will probably be most useful to system administrators and other technical personnel.

To report on event logs, start a new report just as you would for a standard database. You can use the report wizards or the Blank Report option. In either case, expand the NT Current Event Log folder in the Create New Connection category to report on current active event logs on Windows NT/2000/XP computers. Or, you can click the NT Archived Event Log folder to display an Open File dialog box in which to search for archived (.EVT) event log files. If you use this option, upon selecting an event log you will be presented with the Select Archived Event Log dialog box, and you must identify the type of event log you selected (System, Security, or Application).

If you choose the NT Current Event Log folder, you ll see the Select Current Event Log dialog box, as shown in Figure 20-4. This allows you to select an event log on a remote computer ”it doesn t have to reside on the computer that you are running Crystal Reports on. You can even include event logs from more than one computer at a time in your report, if you choose.

Figure 20-4: The Select Current Event Log dialog box

If you know the domain and computer name, you can simply type it in the Computer(s) text box at the top of the dialog box. If you include more than one computer name , separate the names with commas. If you re not sure which computers to include, you can use the Explorer-like hierarchy to select the computers you wish to use. When you see the computer list, you can select one or more computers.

Make your choices and click OK. A new level in the Database Expert will appear for the computer you ve chosen , with the three event logs that are available as tables ”Application, Security, and System ”as shown in the illustration on the opposite page.

Depending on the types of events you want your report to be based on, choose the appropriate log. If you d like a better idea of what types of events are contained in each log, use the Event Viewer application from the Windows Control Panel to view the different event log entries. Once you ve made your log choice, the list of event log fields you can report on will appear in the expert or in the Field Explorer.

Use these event log fields just like other database fields to create your report. You can sort , group , and format the report as you normally would. The Event Viewer application can help you identify what some of the available fields contain. You can use the fields to create flexible selection criteria to narrow down your report, and you can also create formulas, if necessary, to calculate or modify the way event-log material appears in the report. Figure 20-5 (above) shows a sample report based on a Windows NT application event log.

Figure 20-5: Crystal Report based on event log