How to parse EventData from Windows event log?

Question

Hi!
I'm writing a C++ program dealing with Windows events logs.
But I'm confusing how can I parse all details information under the tag EventData from a Windows event record?

Here's what I know so far:

1. How to use WQL to query WMI information.
2. Get all information under tag 'System' in an event.
   (Reference: https://learn.microsoft.com/en-us/windows/win32/wmisdk/example--getting-wmi-data-from-the-local-computer)

The following picture is a snapshot from Microsoft Learn, and the lines marked red is what I wanna get.

Thanks for helping!! :）
Kevin Chiu

Answer 1

Hi @Yen-Ming Chiu You could refer to this document: Retrieving Event Data Using MOF

Or you could use EvtCreateRenderContext with EvtRenderContextValues to get specific properties from the event. See the sample Rendering Events

---

If the answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.