[This is preliminary documentation and subject to change.]
The Win32_NTEventlogFile class inherits several properties from its parent class: CIM_LogicalFile. The following table lists these properties and describes the inherited values:
| Property | Description |
|---|---|
| Readable | Always TRUE. |
| Encrypted | Always FALSE. |
| Open | Determined by calling the Win32 function CreateFile with exclusive access. If the call succeeds, Open is FALSE. If the call fails with a sharing violation, Open is TRUE. If the call fails for another reason, Open is NULL. |
| LastArchivedDate | Always NULL. |
| CSCreationClassName | Always Win32_ComputerSystem. |
| CreationClassName | Always Win32_NTEventlogFile. |
| FSCreationClassName | Always Win32_FileSystem. |
| CSName | Determined by calling the Win32 function GetComputerName. If the call fails, CSName is NULL. |
| FSName | Determined by calling the Win32 function GetVolumeInformation. If the call fails, FSName is NULL. |
| FileType | Determined by looking up the extension without the preceding period ('.') in the list of known file types in the registry. If the extension is not found, FileType contains the characters "File" appended to the extension in upper case. If there is no extension, FileType is NULL. |
The following properties are determined by calling the C run-time function _wfindfirsti64 and querying the _wfinddatei64_t structure that is returned if the call succeeds. If the call fails, the property is set to NULL.:
The Extension and Path properties are determined by parsing the value of the Name property from the end of the string to the beginning. For the Extension property, the parsing process looks for a period ('.'). If a backward slash ('\') is encountered first or a period is not found, Extension is NULL. If a period is found, Extension contains a string consisting of the characters parsed, including the period. For example, if Name is "C:\file.evt", Extension is set to ".evt".
For the Path property, the parsing process looks for a backward slash ('\'). If a backward slash is not found, Path is NULL. If a backward slash is found, Path contains the backward slash appended to a string consisting of the characters that have yet to be parsed. For example, if Name is "C:\file.evt", Path is "C:\".