Logging PC activity to a text file

In PC/Computing september 1993 a "Challenge" appeared.

A reader liked to record each time the computer started up and the magazine
 added the possibility to record program activity.

The request was for a batch file or DEBUG script file solution.
Of course it is possible to echo info from a batchfile, that is going to run
 the application, to a file before and after execution of the application.
Supply program name from command line, date and time info from a .COM or .EXE
 program or even from the date and time commands.
 
I developed DATETIME.COM for this, a small .COM program with output that can be
 redirected to a file.
 
Syntax: DATETIME [ text | +] | [-]
        DATETIME -			"STOP  mm-dd-yyyy hh:mm:ss"           1
        DATETIME +			"START mm-dd-yyyy hh:mm:ss"           2
        DATETIME text			"START mm-dd-yyyy hh:mm:ss text"      3

"Text" in above command can't contain the minus or plus sign, used by 1 and 2
Text can be inserted by the batchfile using replaceble parameters %1 etc

Text can be added to START string by the program if entered on command tail
Program output can be redirected to a text file. Can be used from a batch file
DATETIME can be used in AUTOEXEC.BAT to log bootup time of computer

See on how to use DATETIME.COM demo batchfiles RUN.BAT and LOGTIME.BAT

While working on above problem I also developed "ACTIVITY" a TSR that does
 the job better. No need for batchfiles, however it uses 1300 bytes memory.
 
ACTIVITY comes in 2 flavours a .COM program and as devicedriver, however the
 internals of the programs are the same.

ACTIVITY can work in 2 modes, logging to a file just the time of loading and
 the time of last program activity (MODE 1) or it can log in addition the
 PATHNAME of the program with commandtail and its termination.
ACTIVITY reports program loading/terminating to a file "ACTIVITY.LOG" in
 rootdirectory of startup drive not being a floppy drive.
ACTIVITY catches running of DOS programs under WINDOWS too.
The program intercepts use of INT 21 AX=4B00 LOADEXEC which is used to load and
 execute DOS programs.

Minimum MS-DOS 5.0 is required.
ACTIVITY will not install if less than 1 Mb space on drive is available.
A message will be shown if not able to install.
Logfile ACTIVITY.LOG may grow quite big in MODE 2 as each reported action
 increases the file by 30 or up to 160 bytes (Executing or termination).
ACTIVITY requires about 1300 bytes conventional or upper memory including the
 local stack of 256 bytes it uses.
In case of an error writing to the logfile a beep is sounded.

ACTIVITY operates in 1 of 2 modes once loaded.
Each mode writes as soon as certain action accurs a report to the logfile.
This file is closed immediately after write. So even when the computer is
 rebooted while running a program the very last report is in the logfile.

 MODE 1. Reports "START  dd-mm-yyyy hh:mm:ss  " first time a program is
          loaded to the logfile.
	  Then changes to "STOP   dd-mm-yyyy hh:mm:ss  " for all further
          reporting, either entry or exit of a program.
         This last string is overwritten each next time. So between bootup
          and switching off the computer only 2 reports are left in the file.
         Each report is 30 bytes long including CR LF at end.

 MODE 2. Report each time a program is started or terminated this leaves many
          report lines in the logfile. Each line is 30 or up to 160 bytes long
          depending on length of PATH to the program file and command tail.
         Format report "START  dd-mm-yyyy hh:mm:ss  programname commandtail"
          when starting a program, this changes into
                                "STOP   dd-mm-yyyy hh:mm:ss  " upon terminate
         If INT 21 function 4B00 reports an error by setting CF then second
          format is changed into "FAIL x dd-mm-yyyy hh:mm:ss  " where x is
          the errornumber.

ACTIVITY.COM
Syntax: INSTALL[HIGH]=[path]ACTIVITY.COM [/M] [/H] [/Q] like
 INSTALLHIGH=C:\STARTUP\ACTIVITY.COM which reports first program and last
 program entry/exit to nonhidden ACTIVITY.LOG in root startup drive.
 Succesfull installation will be reported                            MODE 1
ACTIVITY.COM can also be used from AUTOEXEC.BAT or DOS prompt like
 [path]ACTIVITY [/M] [/H] [/Q] 

By using /M on command line, each time a program is executed or terminated
 a report is made to ACTIVITY.LOG.                                   MODE 2

ACTIVITY.LOG may be made into a hidden file by using /H on command line.
This file is a normal ASCII text file. It can be viewed by the TYPE command
 or by using an editor. Remove hidden attribute by running ACTIVITY.COM
 another time without /H.
This works also if ACTIVITY.SYS, see below, has been installed.

By using /Q in command line succesfull installation not reported, failure is.

ACTIVITY.SYS
Syntax: DEVICE[HIGH]=[path]ACTIVITY.SYS [/M] [/H] [/Q] like
 DEVICEHIGH=C:\STARTUP\ACTIVITY.SYS which reports first program and last
 program entry/exit to nonhidden ACTIVITY.LOG in root startup drive.
 Succesfull installation will be reported                            MODE 1

By using /M on CONFIG.SYS line each time a program is executed or terminated
 a report is made to ACTIVITY.LOG.                                   MODE 2

ACTIVITY.LOG may be made into a hidden file by using /H on CONFIG.SYS line.
This file is a normal ASCII text file. It can be viewed by the TYPE command
 or by using an editor. Remove hidden attribute by removing /H from line
 in CONFIG.SYS and reboot the computer. Otherwise as long as ACTIVITY
 is loaded with /H at each non internal command a new hidden copy is created.
Hidden attribute can also be removed by running ACTIVITY.COM without /H.

By using switch /Q succesfull installation is not reported, failure is.

Reason to use a .COM program instead of device driver may be more flexebility
 when to load the program.
Reason to use a devicedriver may be the early loading of a device driver.

;Eric P. van Westendorp    Reigerslaan 22    2215 NN Voorhout   02522 10579