Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 477
  • Last Modified:

An Urgent Problem With Reading Event Logger

why isn't this program returning the correct EventID code
from the logger and always return 0 even when all events in the logger are with diffrent id  ?
In fact this is very much alike the sample program in the
sdk ?


#include  <stdio.h>
#include "events.hpp"
#include <iostream.h>      

void EventThread::RunThread()
{

      HANDLE h,hEvent;
      EVENTLOGRECORD *m_event;
      BYTE bBuffer[MAX_PATH];
      DWORD dwRead,dwNeeded,cRecords=0,dwThisRecord =0;
      

    h = OpenEventLog(NULL,"Application");
    if (h == NULL)
      {
            cout << "can't open the event logger";
      }

      m_event = (EVENTLOGRECORD*) &bBuffer;

      hEvent = CreateEvent( LPSECURITY_ATTRIBUTES(NULL) ,
                                      FALSE,
                                      FALSE,
                                 "EventHandle");

      if (!GetNumberOfEventLogRecords(h,&cRecords))
            cout << "error . Couldn't read or write ";
      else
            cout << "number of records in the system  event log is :"
                   << cRecords << endl;

      cout << "Waiting for more events \n";
      while(1)
      {
            
            NotifyChangeEventLog(h,hEvent);
            WaitForSingleObject(hEvent,INFINITE);
            {
                  ReadEventLog(h,
                         EVENTLOG_BACKWARDS_READ,
                               0,
                               m_event,
                               sizeof(EVENTLOGRECORD),
                               &dwRead,
                               &dwNeeded);
            

      if (m_event->EventType == EVENTLOG_ERROR_TYPE )
                  {
                        switch (m_event->EventID)
                        {
                        case 4:
                              {
                            cout << " ccc was notified about bad sector on disk ";
                              }
                        default:
                              cout << " A Unknown event was raised ";
                        }
                  }
                        
            m_event = (EVENTLOGRECORD*) &bBuffer;
            }
      }

      CloseEventLog(h);
}


UTL_Status EventThread::StopThread(DWORD number)
{

      // TODO
      return 0;
}



void main()
{

      EventThread* local = new EventThread;
      local->RunThread();

}
0
sector
Asked:
sector
1 Solution
 
mwalsh111097Commented:
If you check the return from the ReadEventLog() function, you will find that it is, in fact, failing.  GetLastError returns 0x57, which indicates an invalid parameter to the function.  When you change the flags to be "EVENTLOG_BACKWARDS_READ | EVENTLOG_SEQUENTIAL_READ" and change the buffer size to be "sizeof(bBuffer)" then everything works as it should.
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now