Write-EventLog/New-EventLog shell calls through QProcess not working

[Marko Stanke]

The idea is to write to Windows event logs through shell commands. (I'm using Windows 10)

This simple call from the shell is working perfectly fine: New-EventLog -LogName Application -Source "Test"

But when trying to call it by using QProcess, nothing happens. It seems like the call isn't even made.

QString exec = "New-EventLog";
QStringList params;

params << "-LogName" << "Application";
params << "-Source" << "Test";
p->start(exec, params);
p->waitForFinished();
qDebug() << p->readAllStandardOutput();

[SGaist]

Hi and welcome to devnet,

You should add error checking like verifying the status code and stderr.

[JonB]

@Marko-Stanke
New-EventLog is not a runnable Windows command, e.g. try it from a Command Prompt. It's probably a PowerShell thing? So you have to invoke it that way, via PowerShell executable.

This simple call from the shell is working perfectly fine: New-EventLog -LogName Application -Source "Test"

And what shell would that be from?

Personally I would not write to the Windows Event Log via a process/PowerShell. I would do it inside your own program's code. Either search for a Qt way to do it (edit I searched, there isn't), or use Windows native calls.

[Christian Ehrlicher]

@JonB said in Write-EventLog/New-EventLog shell calls through QProcess not working:

It's probably a PowerShell thing?

Yes

[Marko Stanke]

Thank you for the welcome. And thank you for all the useful information. I didn't know that it was a PowerShell-only thing, with all the help of you I managed to find a workaround that works.

#ifdef _WIN32
    std::string cmd = "powershell New-EventLog -LogName Application -Source 'Test'";
    system(cmd.c_str());
#endif

I already tried searching for a solution to do it inside my own program's code, the thing is I had some issues with using <system.dll> and <mscorlib.dll>. And the things I found didn't help me much (It's probably my lack of experience).

[Christian Ehrlicher]

And why do you now use system() instead QProcess?

[JonB]

@Marko-Stanke
That works. You chose to move over to system(). You could also have done this as per your original with QProcess, just make "powershell" be your exec and "New-EventLog" be the first of your params.

[Marko Stanke]

@Christian-Ehrlicher because I need to implement it in a way without providing the absolute/relative path to the Powershell.

I'm guessing ( As I said I'm not too experienced ) that system() is reading the powershell path from the system environment variables and QProcess not.

Is there a way to run this command through QProcess without providing the absolute/relative path?

[JonB]

@Marko-Stanke
If you can pass powershell as the first word to system(), you should be able to pass that as the executable to your p->start(). Have you actually tried doing so?

[Marko Stanke]

@JonB Yes, it works. Not receiving any output made me think that it doesn't.
This code should return an error as this -Source doesn't exist, but I'm receiving no output.

QString exec = "powershell";
QStringList params;

params << "Write-EventLog";
params << "-LogName" << "Application";
params << "-Source" << "Test";
p->start(exec, params);
p->waitForFinished();
if (!p->waitForFinished())
    qDebug() << "Error output:" << p->errorString();
else
    qDebug() << "Output:" << p->readAll();

Note: For now i'm using waitForFinished() for simplicity of representing the code.

[JonB]

@Marko-Stanke
The "error" you are talking about is not an error running the process. It is just output it will produce. You need to fetch both p->readAllStandardOutput() and p->readAllStandardError(), it's probably in the latter.

[Marko Stanke]

@JonB that's it! Thanks, works perfect now.
To sum up, this is the working code. "New-EventLog" is the same only with less params (LogName, Source needed only).

p = new QProcess();
QString exec = "powershell";
QStringList params;

params << "Write-EventLog";
params << "-LogName" << " 'Application' ";
params << "-Source" << " 'Test' ";
params << "-EventID" << "3001";
params << "-EntryType" << "Warning";
params << "-Message" << " 'Custom message' ";
params << "-RawData"  << "10,20";

p->start(exec, params);
p->waitForFinished();
if (!p->waitForFinished())
    qDebug() << "Error output:" << p->readAllStandardError();
else
    qDebug() << "Output:" << p->readAllStandardOutput();