🚀 go-pugleaf

--------------955E07BD722FC060D991742E
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

I'm writing a little application that needs to read the Windows NT 4.0
Event Logs. I am using the OpenEventLog and ReadEventLog functions (se
code below). But my problem is I don't manage to extract all the
information that you can get if you inspect a event in Windows NT event
wiever. Using code similar to the one below, I esaly get the date, time
and source (who reported the event) but I don't manage to get the
category, User, Computer and description.
I would greatly appreciate any help on this problem!


EVENTLOGRECORD *pevlr;
BYTE bBuffer[BUFFER_SIZE];
DWORD dwRead, dwNeeded, cRecords, dwThisRecord = 0;

    /* Open the Application event log. */

    h = OpenEventLog(NULL, "Application");     /* source  */
        if (h == NULL)
            ErrorExit("could not open Application event log");

    pevlr = (EVENTLOGRECORD *) &bBuffer;

    /*
     * Opening the event log positions the file pointer
     * for this handle at the beginning of the log.
     *
     * Read records sequentially until there
     * are no more.
     */

    while (ReadEventLog(h,                /* event log handle */
                EVENTLOG_FORWARDS_READ |  /* reads forward    */
                EVENTLOG_SEQUENTIAL_READ, /* sequential read  */
                0,            /* ignored for sequential reads */
                pevlr,        /* address of buffer            */
                BUFFER_SIZE,  /* size of buffer               */
                &dwRead,      /* count of bytes read          */
                &dwNeeded)) { /* bytes in next record         */

        while (dwRead > 0) {

            /*
             * Print the event ID, type, and source name.
             * The source name is just past the end of the
             * formal structure.
             */

            printf("%02d  Event ID: 0x%08X ",
                dwThisRecord++, pevlr->EventID);
            printf("EventType: %d Source: %s\n",
                pevlr->EventType, (LPSTR) ((LPBYTE) pevlr +
                sizeof(EVENTLOGRECORD)));

            dwRead -= pevlr->Length;
            pevlr = (EVENTLOGRECORD *)
                ((LPBYTE) pevlr + pevlr->Length);
        }

        pevlr = (EVENTLOGRECORD *) &bBuffer;
    }

    CloseEventLog(h);

Regards,

Niklas Nihlen
niklas@medcom.se

--------------955E07BD722FC060D991742E
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<HTML>


<P>I'm writing a little application that needs to read the Windows NT 4.0
Event Logs. I am using the OpenEventLog and ReadEventLog functions (se
code below). But my problem is I don't manage to extract all the information
that you can get if you inspect a event in Windows NT event wiever. Using
code similar to the one below, I esaly get the date, time and source (who
reported the event) but I don't manage to get the category, User, Computer
and description.
<BR>I would greatly appreciate any help on this problem!
<BR>&nbsp;
<DL><FONT FACE="Courier New,Courier"></FONT>

<P><FONT FACE="Courier New,Courier">EVENTLOGRECORD *pevlr;</FONT>
<BR><FONT FACE="Courier New,Courier">BYTE bBuffer[BUFFER_SIZE];</FONT>
<BR><FONT FACE="Courier New,Courier">DWORD dwRead, dwNeeded, cRecords,
dwThisRecord = 0;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; /* Open the Application
event log. */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; h = OpenEventLog(NULL,
"Application");&nbsp;&nbsp;&nbsp;&nbsp; /* source&nbsp; */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
if (h == NULL)</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ErrorExit("could not open Application event log");</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; pevlr = (EVENTLOGRECORD
*) &amp;bBuffer;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; /*</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; * Opening
the event log positions the file pointer</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; * for this
handle at the beginning of the log.</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; *</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; * Read records
sequentially until there</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; * are no
more.</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; while (ReadEventLog(h,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
/* event log handle */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
EVENTLOG_FORWARDS_READ |&nbsp; /* reads forward&nbsp;&nbsp;&nbsp; */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
EVENTLOG_SEQUENTIAL_READ, /* sequential read&nbsp; */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
0,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /*
ignored for sequential reads */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
pevlr,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* address of buffer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
BUFFER_SIZE,&nbsp; /* size of buffer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&amp;dwRead,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* count of bytes read&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&amp;dwNeeded)) { /* bytes in next record&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
while (dwRead > 0) {</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
/*</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
* Print the event ID, type, and source name.</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
* The source name is just past the end of the</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
* formal structure.</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
printf("%02d&nbsp; Event ID: 0x%08X ",</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
dwThisRecord++, pevlr->EventID);</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
printf("EventType: %d Source: %s\n",</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
pevlr->EventType, (LPSTR) ((LPBYTE) pevlr +</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
sizeof(EVENTLOGRECORD)));</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
dwRead -= pevlr->Length;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
pevlr = (EVENTLOGRECORD *)</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
((LPBYTE) pevlr + pevlr->Length);</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
}</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
pevlr = (EVENTLOGRECORD *) &amp;bBuffer;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; CloseEventLog(h);</FONT><FONT FACE="Courier New,Courier"></FONT>

<P>Regards,

<P>Niklas Nihlen
<BR>niklas@medcom.se</DL>
</HTML>

--------------955E07BD722FC060D991742E--