How to get EVENT LOG RECORD DETAILS.
Posted on 2001-07-04
By the below code I can get the event log record.
I want to get the each event log record details.
If I try to get the event log recoded details from the below code, Details of the logrecord get truncated.
Is there anyway to get it.
I know there log event detail is written in dll
The way to do it may --->
GET eventID--> get Dll from the regestry--> load the dll with Loadlibaray then like this....
Is anyone has the code how to get the detail of each log record. If some one can explain me..How I can do this...
Private Const EVENTLOG_SEQUENTIAL_READ As Long = 1
Private Const EVENTLOG_SEEK_READ As Long = 2
Private Const EVENTLOG_FORWARDS_READ As Long = 4
Private Const EVENTLOG_BACKWARDS_READ As Long = 8
Private Type EVENTLOGRECORD
Length As Long ' Length of full record
Reserved As Long ' Used by the service
RecordNumber As Long ' Absolute record number
TimeGenerated As Long ' Seconds since 1-1-1970
TimeWritten As Long ' Seconds since 1-1-1970
EventID As Long
EventType As Integer
NumStrings As Integer
EventCategory As Integer
ReservedFlags As Integer ' For use with paired events(auditing)
ClosingRecordNumber As Long ' For use with paired events(auditing)
StringOffset As Long ' Offset from beginning of record
UserSidLength As Long
UserSidOffset As Long
DataLength As Long
DataOffset As Long ' Offset from beginning of record
DataBuffer(1 To 1992) As Byte
Private Declare Function OpenEventLog Lib "advapi32.dll" Alias "OpenEventLogA" (ByVal lpUNCServerName As String, ByVal lpSourceName As String) As Long
Private Declare Function ReadEventLog Lib "advapi32.dll" Alias "ReadEventLogA" (ByVal hEventLog As Long, ByVal dwReadFlags As Long, _
ByVal dwRecordOffset As Long, lpBuffer As EVENTLOGRECORD, ByVal nNumberOfBytesToRead As Long, _
pnBytesRead As Long, pnMinNumberOfBytesNeeded As Long) As Long
Private Declare Function CloseEventLog Lib "advapi32.dll" (ByVal hEventLog As Long) As Long
Private Declare Function GetLastError Lib "kernel32" () As Long
Private Sub Form_Load()
Dim r As Long
Dim hEventLog As Long
Dim Event1 As EVENTLOGRECORD
Dim BytesRead As Long
Dim BytesNeeded As Long
Dim i As Long
Dim j As Long
Dim CT As String
Dim b As Byte
Dim c() As Byte
Dim d As String
hEventLog = OpenEventLog(vbNullString, "System")
If hEventLog = 0 Then Exit Sub
i = i + 1
r = ReadEventLog(hEventLog, EVENTLOG_FORWARDS_READ Or EVENTLOG_SEEK_READ, _
i, Event1, 0, BytesRead, BytesNeeded)
If BytesNeeded < LenB(Event1) Then
r = ReadEventLog(hEventLog, EVENTLOG_FORWARDS_READ Or EVENTLOG_SEEK_READ, i, Event1, BytesNeeded, BytesRead, BytesNeeded)
CT = ""
For j = 1 To 100
b = Event1.DataBuffer(j)
If b >= 32 And b < 127 Then
CT = CT & Chr(b)
CT = CT & " "
' List1.AddItem Event1.RecordNumber & vbTab & cT
List1.ListIndex = List1.ListCount - 1
Loop Until r = 0
r = CloseEventLog(hEventLog)