ReadEventLog

The ReadEventLog function reads a whole number of entries from the specified event log. The function can be used to read log entries in chronological or reverse chronological order.

BOOL ReadEventLog(
  HANDLE hEventLog,                // handle to event log
  DWORD dwReadFlags,               // how to read log
  DWORD dwRecordOffset,            // offset of first record
  LPVOID lpBuffer,                 // buffer for read data
  DWORD nNumberOfBytesToRead,      // bytes to read
  DWORD *pnBytesRead,              // number of bytes read
  DWORD *pnMinNumberOfBytesNeeded  // bytes required
);

Parameters

hEventLog

[in] Handle to the event log to read. This handle is returned by the OpenEventLog function.

dwReadFlags

[in] Specifies how the read operation is to proceed. This parameter must include one of the following values.

Value	Meaning
EVENTLOG_SEEK_READ	The read operation proceeds from the record specified by the dwRecordOffset parameter. This flag cannot be used with EVENTLOG_SEQUENTIAL_READ.
EVENTLOG_SEQUENTIAL_READ	The read operation proceeds sequentially from the last call to the ReadEventLog function using this handle. This flag cannot be used with EVENTLOG_SEEK_READ.

If the buffer is large enough, more than one record can be read at the specified seek position; you must specify one of the following flags to indicate the direction for successive read operations.

Value	Meaning
EVENTLOG_FORWARDS_READ	The log is read in chronological order. This flag cannot be used with EVENTLOG_BACKWARDS_READ.
EVENTLOG_BACKWARDS_READ	The log is read in reverse chronological order. This flag cannot be used with EVENTLOG_FORWARDS_READ.

dwRecordOffset

[in] Specifies the log-entry record number at which the read operation should start. This parameter is ignored unless dwReadFlags includes the EVENTLOG_SEEK_READ flag.

lpBuffer

[out] Pointer to a buffer for the data read from the event log. This parameter cannot be NULL, even if the nNumberOfBytesToRead parameter is zero.

The buffer will be filled with an EVENTLOGRECORD structure.

nNumberOfBytesToRead

[in] Specifies the size, in bytes, of the buffer. This function will read as many whole log entries as will fit in the buffer; the function will not return partial entries, even if there is room in the buffer.

pnBytesRead

[out] Pointer to a variable that receives the number of bytes read by the function.

pnMinNumberOfBytesNeeded

[out] Pointer to a variable that receives the number of bytes required for the next log entry. This count is valid only if ReadEventLog returns zero and GetLastError returns ERROR_INSUFFICIENT_BUFFER.

Return Values

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Remarks

When this function returns successfully, the read position in the error log is adjusted by the number of records read. Only a whole number of event log records will be returned.

Note  The configured filename for this source may also be the configured filename for other sources (several sources can exist as subkeys under a single logfile). Therefore, this function may return events that were logged by more than one source.

Requirements

  Windows NT/2000: Requires Windows NT 3.1 or later.
  Windows 95/98: Unsupported.
  Header: Declared in Winbase.h; include Windows.h.
  Library: Use Advapi32.lib.
  Unicode: Implemented as Unicode and ANSI versions on Windows NT/2000.

See Also

Event Logging Overview, Event Logging Functions, ClearEventLog, CloseEventLog, EVENTLOGRECORD, OpenEventLog, ReportEvent