Way to query windows event log?

[dseel]

Hi:

Is there a way to query the windows event log from CVI?

I don't see any of the Windows Event Logger functions available in the windows SDK provided with CVI 8. 

These are the windows logger functions I'm referring to:

http://msdn.microsoft.com/en-us/library/aa385784(VS.85).aspx

I'm interested in capturing application errors from the event logs on stations running Teststand and CVI.

Thanks,
Dave

[menchar · Accepted solution]

You can use the ReadEventLog function.  it's documented in the Windows 2000 RC2 SDK distributed with CVI FDS 8.5.1.  Not sure if it's documented in the SDK distributed with CVI 9.x

ReadEventLog

ReadEventLog

The ReadEventLog function reads a whole number of entries from the specified event log. The function can be used to read log entries in chronological or reverse chronological order.

BOOL ReadEventLog(
  HANDLE hEventLog,                // handle to event log
  DWORD dwReadFlags,               // how to read log
  DWORD dwRecordOffset,            // offset of first record
  LPVOID lpBuffer,                 // buffer for read data
  DWORD nNumberOfBytesToRead,      // bytes to read
  DWORD *pnBytesRead,              // number of bytes read
  DWORD *pnMinNumberOfBytesNeeded  // bytes required
);

Parameters

hEventLog

[in] Handle to the event log to read. This handle is returned by the OpenEventLog function.

dwReadFlags

[in] Specifies how the read operation is to proceed. This parameter must include one of the following values.

Value	Meaning
EVENTLOG_SEEK_READ	The read operation proceeds from the record specified by the dwRecordOffset parameter. This flag cannot be used with EVENTLOG_SEQUENTIAL_READ.
EVENTLOG_SEQUENTIAL_READ	The read operation proceeds sequentially from the last call to the ReadEventLog function using this handle. This flag cannot be used with EVENTLOG_SEEK_READ.

If the buffer is large enough, more than one record can be read at the specified seek position; you must specify one of the following flags to indicate the direction for successive read operations.

Value	Meaning
EVENTLOG_FORWARDS_READ	The log is read in chronological order. This flag cannot be used with EVENTLOG_BACKWARDS_READ.
EVENTLOG_BACKWARDS_READ	The log is read in reverse chronological order. This flag cannot be used with EVENTLOG_FORWARDS_READ.

dwRecordOffset

[in] Specifies the log-entry record number at which the read operation should start. This parameter is ignored unless dwReadFlags includes the EVENTLOG_SEEK_READ flag.

lpBuffer

[out] Pointer to a buffer for the data read from the event log. This parameter cannot be NULL, even if the nNumberOfBytesToRead parameter is zero.

The buffer will be filled with an EVENTLOGRECORD structure.

nNumberOfBytesToRead

[in] Specifies the size, in bytes, of the buffer. This function will read as many whole log entries as will fit in the buffer; the function will not return partial entries, even if there is room in the buffer.

pnBytesRead

[out] Pointer to a variable that receives the number of bytes read by the function.

pnMinNumberOfBytesNeeded

[out] Pointer to a variable that receives the number of bytes required for the next log entry. This count is valid only if ReadEventLog returns zero and GetLastError returns ERROR_INSUFFICIENT_BUFFER.

Return Values

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Remarks

When this function returns successfully, the read position in the error log is adjusted by the number of records read. Only a whole number of event log records will be returned.

Note  The configured filename for this source may also be the configured filename for other sources (several sources can exist as subkeys under a single logfile). Therefore, this function may return events that were logged by more than one source.

Requirements

  Windows NT/2000: Requires Windows NT 3.1 or later.
  Windows 95/98: Unsupported.
  Windows CE: Unsupported.
  Header: Declared in winbase.h; include windows.h.
  Library: Use advapi32.lib.
  Unicode: Implemented as Unicode and ANSI versions on Windows NT/2000.

See Also

Event Logging Overview, Event Logging Functions, ClearEventLog, CloseEventLog, EVENTLOGRECORD, OpenEventLog, ReportEvent

Built on Monday, August 16, 1999

ReadEventLog

[dseel]

Thanks. After a bit more investigation and tweaking, I was able to get this function to work.

Cheers,

Dave

[menchar]

It's a lot of work to figure out the event logging stuff.  I seem to remember creating a dll in Visual Studio with message resources in it to support the event logging.  I used the resource compiler too i believe.  I only used the event log on one project - in retrospect I'm not sure I can say it was worth all the overhead learning how the whole thing works.  But, if you're doing commercial-grade Win32 / Win64 applications, it probably makes sense to know how - I think you have to use the event log to be an official "Windows" application.

Which makes me wonder if it's possible to create a true, Microsoft certified "Windows Application" using CVI?  Can you meet all of the Microsoft Windows Application requirements from CVI?

Menchar