How to retrieve PID from windows event log?
<p><a href="https://i.stack.imgur.com/dgTiR.jpg" rel="nofollow"><img src="https://i.stack.imgur.com/dgTiR.jpg" alt="enter image description here"></a>I have a python code that uses WMI module of python to get windows event viewer logs. But I am unable to retrieve the PID of the process that generated the log.
My code :</p>

<pre><code>wmi_obj = wmi.WMI('.') #Initialize WMI object and query.
wmi_query = "SELECT * FROM Win32_NTLogEvent WHERE Logfile='System' AND EventType=1"
query_result = wmi_obj.query(wmi_query) # Query WMI object
</code></pre>

<p>query_result is a list of wmi objects. Each object in this list is a windows system log and I want PID of the process that generated this log.
I have gone through several msdn docs but couldn't find anything useful there.</p>

<p>I want to retrieve the information marked in the above image.</p>

<p>The Win32 API call to get event log items is <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa363674(v=vs.85).aspx" rel="nofollow">ReadEventLog</a> and this returns <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa363646(v=vs.85).aspx" rel="nofollow">EVENTLOGRECORD</a> structures. These do not have a field for a process identifier so unless your events have included this in the data of the event message it looks like this will not be available.</p>

python wmi pid wmi-query eventviewer