Getting event log in c++

Question

I am trying to get system event log in c++ by using following code , Querying for Event Information.But for some condition i am getting ,Invalid event ID.Value of event ID is 1073742727.Which is wrong.

My code is look like following ,

EVENTLOG_FULL_INFORMATION evntLogInfo;
DWORD dwByteRequd,cbSize=0,dwBytesToRead=MAX_RECORD_BUFFER_SIZE,dwBytesRead,dwMinimumBytesNeeded,numRecord;
PBYTE pBuffer,currentData,endRecord;
HANDLE eventHandle=OpenEventLog(NULL,"Application");
if(eventHandle==INVALID_HANDLE_VALUE)
    cout<<"\nError "<<GetLastError();
else
{
    pBuffer=(PBYTE)malloc(MAX_RECORD_BUFFER_SIZE);
    if(pBuffer==NULL)
    {
        cout<<"\nNot enough memory";
        CloseEventLog(eventHandle);
    }
    else
    {
        //GetEventLogInformation(eventHandle,EVENTLOG_FULL_INFO,&pBuffer,cbSize,&dwByteRequd);
        ReadEventLog(eventHandle,EVENTLOG_SEQUENTIAL_READ|EVENTLOG_FORWARDS_READ,0,pBuffer,dwBytesToRead,&dwBytesRead,&dwMinimumBytesNeeded);

        if(GetLastError()==ERROR_INSUFFICIENT_BUFFER )
        {
            pBuffer=(PBYTE)realloc(pBuffer,dwMinimumBytesNeeded);
            if(pBuffer==NULL)
            {
                    cout<<GetLastError();
                CloseEventLog(eventHandle);
            }
            else
            {
                     dwBytesToRead=dwMinimumBytesNeeded;
                     ReadEventLog(eventHandle,EVENTLOG_SEQUENTIAL_READ|EVENTLOG_FORWARDS_READ,0,pBuffer,dwBytesToRead,&dwBytesRead,&dwMinimumBytesNeeded);
            }
          }
        GetNumberOfEventLogRecords(eventHandle,&numRecord);
        cout<<numRecord<<"\n";
        endRecord=pBuffer+dwBytesToRead;
        while(pBuffer<endRecord)
        {

            currentData=pBuffer;    
            PEVENTLOGRECORD TempVar = (PEVENTLOGRECORD)currentData;
            cout<<((PEVENTLOGRECORD)currentData)->EventID<<"\t";

            cout<<((PEVENTLOGRECORD)currentData)->EventType<<"\t";
            cout<<((PEVENTLOGRECORD)currentData)->Length<<"\n";
            //  DWOR error=GetLastError();

        }
    }
}

Thanks.

westwood · Answer 1 · 2013-07-01T13:32:08.623

0

Long story short, but if you want to see same event ids as event viewr shows you (eventvwr.msc) just print first 2 bytes from your EventID. For example first 2 bytes from 1073742727 is 903.

Long story: now EventID stores so called event's instance id, you can get more info from MSDN.

edited Jul 01 '13 at 13:32

answered Jun 19 '13 at 12:47

westwood

1,774
15
29

Getting event log in c++

1 Answers1