Search
Module:
Directory

   Desktop Functions:

   Smart Device Functions:


Show Recent Changes
Subscribe (RSS)
Misc. Pages
Comments
FAQ
Helpful Tools
Playground
Suggested Reading
Website TODO List
Support Forum
Download Visual Studio Add-In

Terms of Use
Privacy Policy
readeventlog (advapi32)
 
.
Summary
Reads the specified number of entries from the specified event log. The function can be used to read log entries in chronological or reverse chronological order.

C# Signature:

[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto, EntryPoint = "ReadEventLog")]
static extern Boolean ReadEventLog(IntPtr hEventLog, EVT_READ_FLAGS dwReadFlags, UInt32 dwRecordOffset, IntPtr lpBuffer, UInt32 nNumberOfBytesToRead, out UInt32 pnBytesRead, out UInt32 pnMinNumberOfBytesNeeded);

VB Signature:

Declare Function ReadEventLog Lib "advapi32.dll" (TODO) As TODO

User-Defined Types:

None.

Alternative Managed API:

Do you know one? Please contribute it!

Notes:

None.

Tips & Tricks:

Please add some!

Sample Code:

enum EVT_READ_FLAGS : uint

    {
      EVENTLOG_SEEK_READ = 0x0002,
      EVENTLOG_SEQUENTIAL_READ = 0x0001,
      EVENTLOG_FORWARDS_READ = 0x0004,
      EVENTLOG_BACKWARDS_READ = 0x0008
    }

public static int ReadBlockOfRecords(IntPtr hEventLog, out IntPtr pBuff, UInt32 dwRecordNumber)

    {
        int status = 0;
        UInt32 dwBytesRead = 0;
        UInt32 dwMinBytes = 0;
        UInt32 dwBytesToRead = 524287;//max buffer size
        pBuff = Marshal.AllocHGlobal((int) dwBytesToRead);
        if (!ReadEventLog(hEventLog, EVT_READ_FLAGS.EVENTLOG_SEQUENTIAL_READ | EVT_READ_FLAGS.EVENTLOG_BACKWARDS_READ, dwRecordNumber, pBuff, dwBytesToRead, out dwBytesRead, out dwMinBytes))
        {
        status = Marshal.GetLastWin32Error();
        if (status == 122)
        {
            pBuff = Marshal.ReAllocHGlobal(pBuff, (IntPtr)Convert.ToInt32(dwMinBytes));
            dwBytesToRead = dwMinBytes;
            if (!ReadEventLog(hEventLog, EVT_READ_FLAGS.EVENTLOG_SEQUENTIAL_READ | EVT_READ_FLAGS.EVENTLOG_BACKWARDS_READ, dwRecordNumber, pBuff, dwBytesToRead, out dwBytesRead, out dwMinBytes))
            {
            Console.WriteLine("ReadRecord (2) ERROR {0}", Marshal.GetLastWin32Error());
            }
            else
            {
            return Marshal.GetLastWin32Error();
            }

        }
        else
        {
            Console.WriteLine("ReadRecord ERROR {0}", Marshal.GetLastWin32Error());
        }
        }

        return (int)dwBytesRead;
    }

Documentation

Please edit this page!

Do you have...

  • helpful tips or sample code to share for using this API in managed code?
  • corrections to the existing content?
  • variations of the signature you want to share?
  • additional languages you want to include?

Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).

 
Access PInvoke.net directly from VS:
Terms of Use
Edit This Page
Find References
Show Printable Version
Revisions