EVENTLOGRECORD Y2038 issue

Question

Dear Microsoft colleague,

The question is about _EVENTLOGRECORD structure.

typedef struct _EVENTLOGRECORD {

DWORD Length; DWORD Reserved;

DWORD RecordNumber;

DWORD TimeGenerated;

DWORD TimeWritten;

DWORD EventID;

WORD EventType;

WORD NumStrings;

WORD EventCategory;

WORD ReservedFlags;

DWORD ClosingRecordNumber;

DWORD StringOffset;

DWORD UserSidLength;

DWORD UserSidOffset;

DWORD DataLength;

DWORD DataOffset; } EVENTLOGRECORD, *PEVENTLOGRECORD;

TimeGenerated

The time at which this entry was submitted. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.

TimeWritten

The time at which this entry was received by the service to be written to the log. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.

The TimeGenerated and TimeWritten seems not Y2038 safe. Is there a new C++ API/struct that address this issue?

In a future time > Y2038 (and < 2100), is it still possible to get correct TimeGenerated with this structure? e.g.

CTime a64Time ( (time_t)pEventLogRecord->TimeGenerated).

Thank you!

Yuhong

Answer 1

typedef unsigned long DWORD, *PDWORD, *LPDWORD;

TimeGenerated and TimeWritten are defined as unsigned long, so it should still work correctly for quite some years after Y2038.

Answer 2

Hello @Sun, Yu Hong (ADV D AA CN DIH RDH DIV),

Such fields are as log information. It should have no impact on the system while EVENTLOGRECORD structure doesn't involve this condition. You can also submit document feedback about this concern.