Windows system event loging

[0Forest0]

Hi to all. I am going to store errors in the windows event log journal. And Labview has a VI named "Write to system log". But old labview versions haven't that VI.
I have been found a VI on this forums.

But .NET method System(4.0.0.0).Diagnostics\EventLog\createEventSource in it have to get administrator privileges. And this lead to question: how can I run the VI/exe as administrator automaticly. That action will ask user to get more rights. Or how can I use createEventSource in user rights limits?

[rolfk]

You’re making some assumptions here that led you ashtray. The VI you mention does not access the Windows Even Log directly but one of many NI services your system gets swamped with when you install NI software. On Unix platforms it simply accesses the local syslog server. That is a server component that is almost standard available on every Unix installation out of the box and works as a collector for specific UDP messages from whoever  knows the IP address and syslog displays can subscribe to it and read those messages. It is NOT secure as the messages are not encrypted or anything so you should never send sensitive data to a syslog server. NI has a library that you can download in VIPM which should be available for pretty old LabVIEW versions too and can send messages to any syslog server. And there are syslog installers for Windows too or you can build your own in LabVIEW with the mentioned VI library from VIPM.

The Windows Event Log is mostly meant for a way for drivers and system services to report problems during operation. As they execute in the kernel directly (drivers) or in the System execution context (services) they are both highly privileged and faceless too as they have no UI of any kind.

To make your LabVIEW program prompt the user for an according elevation you would have to create a manifest and place it next to your executable. However it’s not a good idea to have your application run elevated all the time for the purpose of sometimes using an API that requires elevation. It opens the system up to many attacks through your elevated process that can only be mitigated by a VERY careful analysis of your entire program including the LabVIEW runtime for which you never will be legally able to obtain its source code! And even if you could, a seasoned C++ programmer would need years to analyse the whole source code for potential security risks.

There are only really two reasons why LabVIEW can be considered fairly safe:

1) It’s equally hard for an attacker to find vulnerabilities in LabVIEW which inevitably will be made more complicated by the different versions out.

2) There are very few LabVIEW executables set to run elevated so that even if someone finds a vulnerebility it’s not very valuable since it can’t easily be abused for really bad things beyond simple DOS attacks.