🚀 go-pugleaf

--------------C74624BE9C24094D26031064
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi Niklas,

Well if you look at VC++ documentation for EVENTLOGRECORD structure,
you'll find this :
typedef struct _EVENTLOGRECORD { // evlr
    DWORD  Length;
    DWORD  Reserved;
    DWORD  RecordNumber;
    DWORD  TimeGenerated;
    DWORD  TimeWritten;
    DWORD  EventID;
    WORD   EventType;
    WORD   NumStrings;
    WORD   EventCategory;
    WORD   ReservedFlags;
    DWORD  ClosingRecordNumber;
    DWORD  StringOffset;
    DWORD  UserSidLength;
    DWORD  UserSidOffset;
    DWORD  DataLength;
    DWORD  DataOffset;
    //
    // Then follow:
    //
    // TCHAR SourceName[]
    // TCHAR Computername[]
    // SID   UserSid
    // TCHAR Strings[]
    // BYTE  Data[]
    // CHAR  Pad[]
    // DWORD Length;
    //
} EVENTLOGRECORD;

You can see that the infos you're looking for are at the end of the
record. It is because these fields are length-variable. Sofar, the
StringOffset field gives you the address of the first byte of the first
string contained in that record, i.e. SourceName.

Hope it helps.

RC
(regis.corbel@cnet.francetelecom.fr)

Niklas Nihlen wrote:

>
>
> I'm writing a little application that needs to read the Windows NT 4.0
> Event Logs. I am using the OpenEventLog and ReadEventLog functions (se
> code below). But my problem is I don't manage to extract all the
> information that you can get if you inspect a event in Windows NT
> event wiever. Using code similar to the one below, I esaly get the
> date, time and source (who reported the event) but I don't manage to
> get the category, User, Computer and description.
> I would greatly appreciate any help on this problem!
>
>
> EVENTLOGRECORD *pevlr;
> BYTE bBuffer[BUFFER_SIZE];
> DWORD dwRead, dwNeeded, cRecords, dwThisRecord = 0;
>
>     /* Open the Application event log. */
>
>     h = OpenEventLog(NULL, "Application");     /* source  */
>         if (h == NULL)
>             ErrorExit("could not open Application event log");
>
>     pevlr = (EVENTLOGRECORD *) &bBuffer;
>
>     /*
>      * Opening the event log positions the file pointer
>      * for this handle at the beginning of the log.
>      *
>      * Read records sequentially until there
>      * are no more.
>      */
>
>     while (ReadEventLog(h,                /* event log handle */
>                 EVENTLOG_FORWARDS_READ |  /* reads forward    */
>                 EVENTLOG_SEQUENTIAL_READ, /* sequential read  */
>                 0,            /* ignored for sequential reads */
>                 pevlr,        /* address of buffer            */
>                 BUFFER_SIZE,  /* size of buffer               */
>                 &dwRead,      /* count of bytes read          */
>                 &dwNeeded)) { /* bytes in next record         */
>
>         while (dwRead > 0) {
>
>             /*
>              * Print the event ID, type, and source name.
>              * The source name is just past the end of the
>              * formal structure.
>              */
>
>             printf("%02d  Event ID: 0x%08X ",
>                 dwThisRecord++, pevlr->EventID);
>             printf("EventType: %d Source: %s\n",
>                 pevlr->EventType, (LPSTR) ((LPBYTE) pevlr +
>                 sizeof(EVENTLOGRECORD)));
>
>             dwRead -= pevlr->Length;
>             pevlr = (EVENTLOGRECORD *)
>                 ((LPBYTE) pevlr + pevlr->Length);
>         }
>
>         pevlr = (EVENTLOGRECORD *) &bBuffer;
>     }
>
>     CloseEventLog(h);
>
> Regards,
>
> Niklas Nihlen
> niklas@medcom.se
>


--------------C74624BE9C24094D26031064
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit

<HTML>
Hi Niklas,

<P>Well if you look at VC++ documentation for EVENTLOGRECORD structure,
you'll find this :
<BR>typedef struct _EVENTLOGRECORD { // evlr
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; Length;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; Reserved;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; RecordNumber;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; TimeGenerated;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; TimeWritten;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; EventID;
<BR>&nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; EventType;
<BR>&nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; NumStrings;
<BR>&nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; EventCategory;
<BR>&nbsp;&nbsp;&nbsp; WORD&nbsp;&nbsp; ReservedFlags;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; ClosingRecordNumber;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; StringOffset;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; UserSidLength;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; UserSidOffset;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; DataLength;
<BR>&nbsp;&nbsp;&nbsp; DWORD&nbsp; DataOffset;
<BR>&nbsp;&nbsp;&nbsp; //
<BR>&nbsp;&nbsp;&nbsp; // Then follow:
<BR>&nbsp;&nbsp;&nbsp; //
<BR>&nbsp;&nbsp;&nbsp; // TCHAR SourceName[]
<BR>&nbsp;&nbsp;&nbsp; // TCHAR Computername[]
<BR>&nbsp;&nbsp;&nbsp; // SID&nbsp;&nbsp; UserSid
<BR>&nbsp;&nbsp;&nbsp; // TCHAR Strings[]
<BR>&nbsp;&nbsp;&nbsp; // BYTE&nbsp; Data[]
<BR>&nbsp;&nbsp;&nbsp; // CHAR&nbsp; Pad[]
<BR>&nbsp;&nbsp;&nbsp; // DWORD Length;
<BR>&nbsp;&nbsp;&nbsp; //
<BR>} EVENTLOGRECORD;

<P>You can see that the infos you're looking for are at the end of the
record. It is because these fields are length-variable. Sofar, the StringOffset
field gives you the address of the first byte of the first string contained
in that record, i.e. SourceName.

<P>Hope it helps.

<P>RC
<BR>(regis.corbel@cnet.francetelecom.fr)

<P>Niklas Nihlen wrote:
<BLOCKQUOTE TYPE=CITE>&nbsp;

<P>I'm writing a little application that needs to read the Windows NT 4.0
Event Logs. I am using the OpenEventLog and ReadEventLog functions (se
code below). But my problem is I don't manage to extract all the information
that you can get if you inspect a event in Windows NT event wiever. Using
code similar to the one below, I esaly get the date, time and source (who
reported the event) but I don't manage to get the category, User, Computer
and description.
<BR>I would greatly appreciate any help on this problem!
<BR>&nbsp;
<DL><FONT FACE="Courier New,Courier">EVENTLOGRECORD *pevlr;</FONT>
<BR><FONT FACE="Courier New,Courier">BYTE bBuffer[BUFFER_SIZE];</FONT>
<BR><FONT FACE="Courier New,Courier">DWORD dwRead, dwNeeded, cRecords,
dwThisRecord = 0;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; /* Open the Application
event log. */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; h = OpenEventLog(NULL,
"Application");&nbsp;&nbsp;&nbsp;&nbsp; /* source&nbsp; */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
if (h == NULL)</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
ErrorExit("could not open Application event log");</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; pevlr = (EVENTLOGRECORD
*) &amp;bBuffer;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; /*</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; * Opening
the event log positions the file pointer</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; * for this
handle at the beginning of the log.</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; *</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; * Read records
sequentially until there</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; * are no
more.</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp; */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; while (ReadEventLog(h,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
/* event log handle */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
EVENTLOG_FORWARDS_READ |&nbsp; /* reads forward&nbsp;&nbsp;&nbsp; */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
EVENTLOG_SEQUENTIAL_READ, /* sequential read&nbsp; */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
0,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /*
ignored for sequential reads */</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
pevlr,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* address of buffer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
BUFFER_SIZE,&nbsp; /* size of buffer&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&amp;dwRead,&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; /* count of bytes read&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&amp;dwNeeded)) { /* bytes in next record&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
while (dwRead > 0) {</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
/*</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
* Print the event ID, type, and source name.</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
* The source name is just past the end of the</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
* formal structure.</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
*/</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
printf("%02d&nbsp; Event ID: 0x%08X ",</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
dwThisRecord++, pevlr->EventID);</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
printf("EventType: %d Source: %s\n",</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
pevlr->EventType, (LPSTR) ((LPBYTE) pevlr +</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
sizeof(EVENTLOGRECORD)));</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
dwRead -= pevlr->Length;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
pevlr = (EVENTLOGRECORD *)</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
((LPBYTE) pevlr + pevlr->Length);</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
}</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
pevlr = (EVENTLOGRECORD *) &amp;bBuffer;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; }</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;</FONT>
<BR><FONT FACE="Courier New,Courier">&nbsp;&nbsp;&nbsp; CloseEventLog(h);</FONT>

<P>Regards,

<P>Niklas Nihlen
<BR>niklas@medcom.se</DL>
</BLOCKQUOTE>
&nbsp;</HTML>

--------------C74624BE9C24094D26031064--