Article 3533 of microsoft.public.win32.programmer.kernel:
I am trying to read the EventLog and I am runing into an add problem:
Regardless of which EventLog I ask to open, I always read the
Application Log!  What gives?  I am running NT WKS 4.0 w/SP3.

Here is the code:

#include <stdio.h>
#include <stdlib.h>
#include <systypes.h>
#include <string.h>
#include <process.h>
#include <windows.h>
#define MAX_MSG_LENGTH 1024
#define MSG_ID_MASK 0x0000FFFF
#define MACHINE NULL

#define PERR(bSuccess, api) {if (!(bSuccess)) printf("\n%s: Error %d \
from %s on line %d\n", __FILE__, GetLastError(), api, __LINE__);}

void prntEventLog(HANDLE hEventLog, LPCTSTR pszLogName, LPCTSTR
pszSourceName)
{
  EVENTLOGRECORD *pevlr;
  BYTE bBuffer[1024 * 64];    // hold the event log record raw data
  DWORD dwRead, dwNeeded, dwThisRecord = 0;
  HANDLE hLog;                // handle to the log
  BOOL bSuccess;
  DWORD cRecords;             // number of event records in the log
 
  if (!hEventLog)
  {
    hLog = OpenEventLog(NULL,  // use local machine
        pszSourceName);        // source name - assumed to be valid
    PERR(hLog, "OpenEventLog");
  }
  else
    hLog = hEventLog;

  // Get the number of records in the log.
  bSuccess = GetNumberOfEventLogRecords(hLog, &cRecords);
  PERR(bSuccess, "GetNumberOfEventLogRecords");
  printf("There are %d records in the %s (%s) log.\n", cRecords,
pszLogName,
   pszSourceName);
  pevlr = (EVENTLOGRECORD *) &bBuffer;
  /* Opening the log positions the file pointer for this handle at the
     beginning of the log. Read records sequentially until there are no
more
     records. */
  while (bSuccess = ReadEventLog(hLog,  // event-log handle
          EVENTLOG_FORWARDS_READ |      // read forward
          EVENTLOG_SEQUENTIAL_READ,     // sequential read
          (DWORD) 0,                    // ignored for sequential reads
          bBuffer,                      // address of buffer
          sizeof(bBuffer),              // size of buffer
          &dwRead,                      // count of bytes read
          &dwNeeded))                   // bytes in next record
  {
    while (dwRead > 0)
    {
      /* Print the event ID, type, source name, and category. The source
name
         is just past the end of the formal structure. */
      printf("\n%03d  Event ID: 0x%08X  EventType: ", dwThisRecord++,
          pevlr->EventID);
      printf("\nSource: %s", (LPSTR) ((LPBYTE) pevlr +
sizeof(EVENTLOGRECORD)));      // mask off the actual message number and
show it
      printf("  Message ID: %d\n", pevlr->EventID & MSG_ID_MASK);
      // Subtract the size of the event log record we just read
      dwRead -= pevlr->Length;
      // Point to the next event log record in the buffer
                pevlr = (EVENTLOGRECORD *) ((LPBYTE) pevlr +
pevlr->Length);
    } // while
    /* reset our event log record pointer back to the beginning of the
buffer
       in preparation for reading the next record. */
    pevlr = (EVENTLOGRECORD *) &bBuffer;
  } // while
  if (GetLastError() != ERROR_HANDLE_EOF)
         PERR(bSuccess, "ReadEventLog");
  if (!hEventLog)  // if we had to open the event log, close it
  {
    bSuccess = CloseEventLog(hLog);
    PERR(bSuccess, "CloseEventLog");
  }
  return;
} // prntEventLog

void usage()
{
  puts("log [logname] >");
  puts("[logname] is one of: Application, Security, or System.");
  return;
} // usage()
 
int main(int argc, char *argv[])
{
  TCHAR szTemp[MAX_PATH], szName[80];
  BOOL bSuccess;
 
  if (argc == 1) {  /* no args, use default defines */
        sprintf(szTemp,
"System\\CurrentControlSet\\Services\\EventLog\\Security");
        sprintf(szName, "Security");
        prntEventLog(NULL, szName, szTemp);  // query the log
        } else {
         if (argc > 1 && (!strcmpi(argv[1], "Application") ||
    !strcmpi(argv[1], "Security") || !strcmpi(argv[1], "System")))
         {
                  // get arbitrary subkey of param to be used to open
event log
                  sprintf(szTemp,
"System\\CurrentControlSet\\Services\\EventLog\\%s",
                                argv[1]);
                  prntEventLog(NULL, argv[1], szTemp);  // query the log
         }
  }
  return(0);
}


-- 
--Haral Tsitsivas,  UniSolutions Associates (http://www.unisol.com/)
  Voice: (714) 488-3960,  Fax: (714) 443-5354,  E-mail: haral@unisol.com


