Userenv.log, Windows XP, and gibberish

Usage and Config Platform
1

(imported topic written by upinya91)

Trying to work with the Windows debug log, in Relevance Debugger 2.0.0.3, and it reads the file as gibberish.

q: line 1 of file “C:\WINDOWS\Debug\UserMode\userenv.log”

A: U%00S%00E%00R%00E%00N%00V%00(%00f%009%00c%00.%009%001%004%00)%00 %000%009%00:%003%000%00:%002%005%00:%006%009%008%00 %00I%00n%00i%00t%00i%00a%00l%00i%00z%00e%00P%00o%00l%00i%00c%00y%00P%00r%00o%00c%00e%00s%00s%00i%00n%00g%00:%00 %00I%00n%00i%00t%00i%00a%00l%00i%00s%00e%00d%00 %00M%00a%00c%00h%00i%00n%00e%00 %00M%00u%00t%00e%00x%00/%00E%00v%00e%00n%00t%00s%00

looks like it’s coding between the characters, a la HTML…

it should read:

USERENV(f9c.914) 09:30:25:698 InitializePolicyProcessing: Initialised Machine Mutex/Events

Thanks!

2

(imported comment written by SystemAdmin)

Q: concatenation “” of (substrings separated by “%00” of “U%00S%00E%00R%00E%00N%00V%00(%00f%009%00c%00.%009%001%004%00)%00 %000%009%00:%003%000%00:%002%005%00:%006%009%008%00 %00I%00n%00i%00t%00i%00a%00l%00i%00z%00e%00P%00o%00l%00i%00c%00y%00P%00r%00o%00c%00e%00s%00s%00i%00n%00g%00:%00 %00I%00n%00i%00t%00i%00a%00l%00i%00s%00e%00d%00 %00M%00a%00c%00h%00i%00n%00e%00 %00M%00u%00t%00e%00x%00/%00E%00v%00e%00n%00t%00s%00”)

A: USERENV(f9c.914) 09:30:25:698 InitializePolicyProcessing: Initialised Machine Mutex/Events

So: concatenation “” of (substrings separated by “%00” of (line 1 of file “C:\WINDOWS\Debug\UserMode\userenv.log”))

(taken from here: http://forum.bigfix.com/viewtopic.php?id=3339)

  • John
3

(imported comment written by SystemAdmin)

So, after speaking with Peter (upinya), we’re now looking for how to do the reverse. That is, how would we get BF to turn “Random String” into “R%00a%00n%00d%00o%00m%00 %00S%00t%00r%00i%00n%00g”?

4

(imported comment written by SystemAdmin)

Figured it out.

q: concatenation “%00” of (characters of “Random String”)

A: R%00a%00n%00d%00o%00m%00 %00S%00t%00r%00i%00n%00g

  • John
5

(imported comment written by upinya91)

getting far on this, just need to only show the latest time…

q: firsts 9 of following texts of firsts 16 of (concatenation “” of substrings separated by “%00” of it) of lines whose (it contains “P%00r%00o%00c%00e%00s%00s%00G%00P%00O%00s%00:%00 %00 %00S%00t%00a%00r%00t%00i%00n%00g%00 %00c%00o%00m%00p%00u%00t%00e%00r%00 %00G%00r%00o%00u%00p%00 %00P%00o%00l%00i%00c%00y%00 %00(%00B%00a%00c%00k%00g%00r%00o%00u%00n%00d%00)%00 %00p%00r%00o%00c%00e%00s%00s%00i%00n%00g%00.%00.%00.”) of file “C:\WINDOWS\Debug\UserMode\userenv.log”

A: 11:04:50

A: 12:41:53

6

(imported comment written by upinya91)

any way to get the last entry only?

q: (firsts 11 of following texts of firsts 5 of (modification time of file “C:\WINDOWS\Debug\UserMode\userenv.log” as string)),(firsts 8 of following texts of firsts 17 of (concatenation “” of substrings separated by “%00” of it) of lines whose (it contains “P%00r%00o%00c%00e%00s%00s%00G%00P%00O%00s%00:%00 %00 %00S%00t%00a%00r%00t%00i%00n%00g%00 %00c%00o%00m%00p%00u%00t%00e%00r%00 %00G%00r%00o%00u%00p%00 %00P%00o%00l%00i%00c%00y%00 %00(%00B%00a%00c%00k%00g%00r%00o%00u%00n%00d%00)%00 %00p%00r%00o%00c%00e%00s%00s%00i%00n%00g%00.%00.%00.”) of file “C:\WINDOWS\Debug\UserMode\userenv.log”)

A: 09 Apr 2010, 09:06:12

A: 09 Apr 2010, 10:59:27

A: 09 Apr 2010, 12:47:30

A: 09 Apr 2010, 14:36:33