CF_EV_SCOPE_FILTER clipboard format

The CF_EV_SCOPE_FILTER clipboard format returns the filter settings. This clipboard format applies only to the Scope node type. Additionally, filter settings are not in effect unless the VIEWINFO_FILTERED flag is set. The VIEWINFO_FILTERED flag applies to the flViewFlags member of the CF_EV_SCOPE clipboard format.

Data Format

The data provided by this clipboard format is structured as follows.

ULONG   flRecType,
USHORT  usCategory,
BOOL    fEventID,
ULONG   ulEventID,
USHORT  cchSource,
WCHAR   wszSource[],
USHORT  cchUser,
WCHAR   wszUser[],
USHORT  cchComputer,
WCHAR   wszComputer[],
ULONG   ulFrom,
ULONG   ulTo

Member

flRecType

A value that specifies which event types are included in the view. This value is a bitwise OR of zero or more of the following flags. These flags are defined in WinNT.h. For more information, see Event Types.

Flag	Description
EVENTLOG_AUDIT_FAILURE	Failure audit event
EVENTLOG_AUDIT_SUCCESS	Success audit event
EVENTLOG_ERROR_TYPE	Error event
EVENTLOG_INFORMATION_TYPE	Information event
EVENTLOG_WARNING_TYPE	Warning event

 

usCategory

If this value is zero, then a category is not used in the filter. If this value is nonzero, then usCategory specifies a category for the filter. Categories are defined by the event source.

fEventID

A value that specifies whether the view is filtered by an event ID. If fEventID is TRUE, then the view is restricted to the events matching the ulEventID value.

ulEventID

Event ID. This value should be ignored unless fEventID is TRUE.

cchSource

Number of characters, including the terminating null character, in wszSource.

wszSource

Null-terminated Unicode string specifying the name of the source (for example, application, service, driver, or subsystem) that generated the event.

cchUser

Number of characters, including the terminating null character, in wszUser.

wszUser

Null-terminated Unicode string specifying the name of the user when the event was logged. Be aware that some events are not attributed to a specific user.

cchComputer

Number of characters, including the terminating null character, in wszComputer.

wszComputer

Null-terminated Unicode string specifying the name of the computer that generated this event.

ulFrom

A value that specifies the beginning of the interval of events being filtered. If this value is zero, then there is no minimum timestamp on the filtered event records. If this value is nonzero, then ulFrom is the number of elapsed seconds since 00:00:00 January 1, 1970, Universal Coordinated Time. The ulFrom member serves as the minimum timestamp for the filtered event. That is, the ulFrom value is compared to the event log record time value, as specified by the TimeGenerated member of the EVENTLOGRECORD structure.

ulTo

A value that specifies the end of the interval of events being filtered. If this value is zero, then there is no maximum timestamp on the filtered event records. If this value is nonzero, then ulTo is the number of elapsed seconds since 00:00:00 January 1, 1970, Universal Coordinated Time. The ulTo member serves as the maximum timestamp for the filtered event. That is, the ulTo value is compared to the event log record time value, as specified by the TimeGenerated member of the EVENTLOGRECORD structure.

Note

On 64-bit platforms, padding may be used by the CF_EV_SCOPE_FILTER clipboard format so that the data is naturally aligned. For example, padding could occur at the end of a string if the string contains an odd number of wide characters.