[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

How to use OpenEventLog?

Posted on 1998-08-25
8
Medium Priority
?
2,347 Views
Last Modified: 2008-02-01
(Platform: Win NT4.0 VC++ 5.0)
I am trying to retrieve a (card) driver's messages in the Event Log using OpenEventLog and ReadEventLog. The Registry shows the driver source name as being available.
../System/CurrentControlSet/Services/EventLog/System/EiconCards

My call to OpenEventLog returns a valid handle and looks like this:
hEicon = OpenEventLog( NULL, "EiconCards" );

My first problem arises when I ask for the number of records using
GetNUmberOfEventLogRecords( hEicon, &NumberOfRecords ).

The NumberOfRecords=700 but  I only have 6 EiconCards related messages in the Event Log!? I think it returns the entire records available in Event Log. Should I expect only records for the Source Name I specify?

When I go ahead and use ReadEventLog, I do not get the Records associated with EiconCards but some other service.

Any suggestions concerning my problem?
0
Comment
Question by:domenic
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 1

Author Comment

by:domenic
ID: 1171235
Edited text of question
0
 
LVL 23

Expert Comment

by:chensu
ID: 1171236
According to the documentation, the second parameter of OpenEventLog "can be the Application, Security, or System logfile, or a custom registered logfile. If a custom registered logfile name cannot be found, the event logging service opens the Application logfile, however, there will be no associated message or category string file." I think the parameter is not for a source name. In your case, you actually opened the Application logfile.
0
 
LVL 1

Author Comment

by:domenic
ID: 1171237
Chensu, to go over one point you said concerning it opening up the Application logfile, it didn't. If I look into the Event Log I match what my app  has printed with entries in the System log including strings. The source name I specified is ( like I mentioned in the original message) a valid subkey of the System logfile.

So OpenEventLog opens up either the Application, the Security or the System logfile. I assumed it would go further and return only the records associated with the source name I specified. For example, if I specified "EiconCards", I expected only records in the System log that dealt with "EiconCards".  Hence, I must parse thru each record in the System log to look for the corresponding "EiconCards" records. (Sounds time-consuming and I must keep the System log clean at all times to enhance performance.  I will try to implement NotifyChangeEventLog to avoid queries)

If there is anything you can add I will appreciate it otherwise let us close this question and thanks again.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
LVL 23

Expert Comment

by:chensu
ID: 1171238
Just in case you haven't read it, I copied the following example useful for you from the documentation.

Reading the Event Log
The following example reads all the records in the Application log file and displays the event identifier, event type, and event source for each event log entry.

void DisplayEntries( )
{
    HANDLE h;
    EVENTLOGRECORD *pevlr;
    BYTE bBuffer[BUFFER_SIZE];
    DWORD dwRead, dwNeeded, cRecords, dwThisRecord = 0;
 
    // Open the Application event log.
 
    h = OpenEventLog( NULL,             // use local computer
             "Application");   // source name
    if (h == NULL)
        ErrorExit("Could not open the Application event log.");
 
    pevlr = (EVENTLOGRECORD *) &bBuffer;
 
    // Opening the event log positions the file pointer for this
    // handle at the beginning of the log. Read the records
    // sequentially until there are no more.
 
    while (ReadEventLog(h,                // event log handle
                EVENTLOG_FORWARDS_READ |  // reads forward
                EVENTLOG_SEQUENTIAL_READ, // sequential read
                0,            // ignored for sequential reads
                pevlr,        // pointer to buffer
                BUFFER_SIZE,  // size of buffer
                &dwRead,      // number of bytes read
                &dwNeeded))   // bytes in next record
    {
        while (dwRead > 0)
        {
            // Print the event identifier, type, and source name.
            // The source name is just past the end of the
            // formal structure.
 
            printf("%02d  Event ID: 0x%08X ",
                dwThisRecord++, pevlr->EventID);
            printf("EventType: %d Source: %s\n",
                pevlr->EventType, (LPSTR) ((LPBYTE) pevlr +
                sizeof(EVENTLOGRECORD)));
 
            dwRead -= pevlr->Length;
            pevlr = (EVENTLOGRECORD *)
                ((LPBYTE) pevlr + pevlr->Length);
        }
 
        pevlr = (EVENTLOGRECORD *) &bBuffer;
    }
 
    CloseEventLog(h);
}

0
 
LVL 1

Author Comment

by:domenic
ID: 1171239
I have seen and read this sample code and it did come in handy.  (BUFFER_SIZE ?)
0
 
LVL 23

Expert Comment

by:chensu
ID: 1171240
The documentation does not say the value of BUFFER_SIZE. It may be 1024 or 2048.
0
 

Accepted Solution

by:
AlanB082898 earned 240 total points
ID: 1171241
domenic,

No, you shouldn't only expect records for the source name you specify.  As you've already found out you get all the records.  The source name is usefull for getting the message associated with an event from the event message file. You need to make sure you open the log that your events were written to, application, security, or system.  You can verify this by in the event viewer, start/programs/administrative tools (common)/Event Viewer. From the event viewer pull down the Log menu and select click Application.  Then pull down the view menu and select Filter Events... . In the Filter dialog enter EiconCards in the Source edit box.  If there are any events for the card they should show up. You probably already know all this.
When you use ReadEventLog you'll get all the records.  My suggestion is to read all the records but only save off or record the ones that have "EiconCards" as the source.
Reading the event log records may present difficulties if the buffer size is not right.
One approach I read about was to make a call to readeventlog with 0 as nNumberOfBytesToRead which will cause readeventlog to return the correct size in pnMinNumberOfBytesNeeded if readeventlog returns 0 and GetLastError returns ERROR_INSUFFICIENT_BUFFER.  Then you can make a buffer that's the correct size and call readeventlog again.

Michael Swartzendruber has a good example, with downloadable sourcecode at:
http://www.microsoft.com/mind/0998/weasel.htm 
This article he wrote for MicroSoft Interactive Developer describes how to view the event log in an html page but the parts on reading the event log may be helpful to you.
0
 
LVL 1

Author Comment

by:domenic
ID: 1171242
Thanks AlanB. You suggestions are accurate but I have completed this problem already. I did want Chensu to close it ( see 2nd Comment before this one) because I was done with this issue. Thanks anyway.
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Ready to improve network connectivity? Watch this webinar to learn how SD-WANs and a one-click instant connect tool can boost provisions, deployment, and management of your cloud connection.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

  Included as part of the C++ Standard Template Library (STL) is a collection of generic containers. Each of these containers serves a different purpose and has different pros and cons. It is often difficult to decide which container to use and …
This article will show you some of the more useful Standard Template Library (STL) algorithms through the use of working examples.  You will learn about how these algorithms fit into the STL architecture, how they work with STL containers, and why t…
The viewer will learn how to user default arguments when defining functions. This method of defining functions will be contrasted with the non-default-argument of defining functions.
The viewer will learn additional member functions of the vector class. Specifically, the capacity and swap member functions will be introduced.
Suggested Courses

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question