Using ReadEventLog()

Thread View: borland.public.cppbuilder.nativeapi

3 messages

[T] Back to Threads [V] Tree View [G] Group Articles

3 total messages Started by St�phane Lambert Mon, 14 Apr 2008 01:25

#433

Author: St�phane Lambert
Date: Mon, 14 Apr 2008 01:25

49 lines
2081 bytes

Hi,

I wish to read the "Application" or "Service" event log on a Windows XP Pro.
system using the following code:

// CODE START:

HANDLE hSystemEventLog = OpenEventLog( NULL, "Application" );
//HANDLE hSystemEventLog = OpenEventLog( NULL, "System" );
//HANDLE hSystemEventLog = OpenEventLog( NULL, "Service Control Manager" );

if ( hSystemEventLog != NULL )
{
  EVENTLOGRECORD CurrentEventLogRecord = {0};
  DWORD dwBytesRead = 0;
  DWORD dwBytesNeeded = 0;

  bool bSucceeded = ReadEventLog( hSystemEventLog,
                                  EVENTLOG_BACKWARDS_READ |
EVENTLOG_SEQUENTIAL_READ,
                                  0,
                                  &CurrentEventLogRecord,
                                  sizeof( CurrentEventLogRecord ),
                                  &dwBytesRead,
                                  &dwBytesNeeded );

  if ( bSucceeded == false )
  {
   showWindowsLastErrorMessage();
  }
  else
  {
   printf( "\nEvent ID: %d\n", CurrentEventLogRecord.EventID );
  }

  CloseEventLog( hSystemEventLog );
}

// CODE END.

When this code is executed, I get the following error:

 The data area passed to a system call is too small.

What's the problem with this code?

Thanks,

Stephane Lambert

Re: Using ReadEventLog()

#434

Author: Bob Gonder
Date: Mon, 14 Apr 2008 02:34

27 lines
1986 bytes

St�phane Lambert wrote:

>  EVENTLOGRECORD CurrentEventLogRecord = {0};
>  bool bSucceeded = ReadEventLog( hSystemEventLog,
>            EVENTLOG_BACKWARDS_READ | EVENTLOG_SEQUENTIAL_READ,
>                                  0,
>                                  &CurrentEventLogRecord,
>                                  sizeof( CurrentEventLogRecord ),
>                                  &dwBytesRead,
>                                  &dwBytesNeeded );
>  if ( bSucceeded == false )
>  {
>   showWindowsLastErrorMessage();

Also display sizeof(CurrentEventLogRecord) and dwBytesNeeded.
I suspect dwBytesNeeded is larger by a few bytes.

>When this code is executed, I get the following error:
> The data area passed to a system call is too small.
>
>What's the problem with this code?

Microsoft's example code uses a (large) char buffer,
and a moveable struct pointer. They also mention
there might be padding bytes added to the struct.
If you were supposed to read directly into a struct,
they probably would have shown it that way.

Re: Using ReadEventLog()

#438

Author: St�phane Lambert
Date: Tue, 15 Apr 2008 06:48

21 lines
1323 bytes

Hi Bob,

Thanks for your reply.

You are right. There is 112 bytes of difference between "sizeof(
CurrentEventLogRecord )" and "dwBytesNeeded".

Using the line:

    sizeof( CurrentEventLogRecord ) + 112;

or better:

    EVENTLOGRECORD * pCurrentEventLogRecord = new EVENTLOGRECORD[
dwBytesNeeded ];

correct the problem.

Thanks again,

Stephane

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads