Get Incorrect handle as error with GetFileSizeEx

Question

My goal is to find the size of log files which is present in (%SystemRoot%\System32\winevt\logs) using c++ (For Eg : To get the file size of Application.evtx). I tried with GetFileSizeEx (https://learn.microsoft.com/fr-fr/windows/win32/api/fileapi/nf-fileapi-getfilesizeex) method but i got error like incorrect handle is passed. Passed three handle with (EvtQuery,EvtGetChannelConfigProperty,OpenEventLog) to GetFileSizeEx but i get the same error. Can i know what handle should be passed to get the size:

Find the similar question (How to find the size of log files using EvtQuery function?). Tried this but I got invalid handle as error with GetFileSizeEx.

https://en.cppreference.com/w/cpp/filesystem/file_size – pm100 Feb 27 '22 at 18:26 — pm100, Feb 27 '22 at 18:26
@Naresh please post *YOUR* code that uses GetFileSizeEx – pm100 Feb 28 '22 at 17:44 — pm100, Feb 28 '22 at 17:44

score 0 · Answer 1 · answered Feb 28 '22 at 21:11

The default file location is C:\Windows\System32\winevt\Logs

The application log is called Application.evtx

If you want to get its size do

#include <iostream>
#include <filesystem>

int main() {

    std::filesystem::path example = "C:\\Windows\\System32\\winevt\\Logs\\Application.evtx";
    std::cout << example << " size = " << std::filesystem::file_size(example) << '\n';
}

If you want to be sure to get the correct location becuase an admin can move it then look here in the registry

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\File

to get the file name

I get exception like "The system cannot find the path specified." . I think there is only one way to get the log file size by using winapi's . Because i get the same error ("The system cannot find the path specified") when i tried using file operation and stats. — Naresh, Mar 01 '22 at 05:56

score 0 · Answer 2 · answered Mar 01 '22 at 07:11

0

According to the Doc:GetFileSizeEx function

The handle must have been created with the FILE_READ_ATTRIBUTES access right or equivalent, or the caller must have sufficient permission on the directory that contains the file.

Whether you have checked the result of opening the file to get the file handle? If the file failed to open, you're calling GetFileSizeEx with an invalid handle.

answered Mar 01 '22 at 07:11

Jeaninez - MSFT

3,210
1
5
20

Handle is created without any error . I can do other operation with the handle – Naresh Mar 01 '22 at 08:10

Get Incorrect handle as error with GetFileSizeEx

2 Answers2