EvtGetQueryInfo function (winevt.h)

Article
02/22/2024

Gets information about a query that you ran that identifies the list of channels or log files that the query attempted to access. The function also gets a list of return codes that indicates the success or failure of each access.

Syntax

BOOL EvtGetQueryInfo(
  [in]  EVT_HANDLE            QueryOrSubscription,
  [in]  EVT_QUERY_PROPERTY_ID PropertyId,
  [in]  DWORD                 PropertyValueBufferSize,
  [in]  PEVT_VARIANT          PropertyValueBuffer,
  [out] PDWORD                PropertyValueBufferUsed
);

Parameters

[in] QueryOrSubscription

A handle to the query that theEvtQuery or EvtSubscribe function returns.

[in] PropertyId

The identifier of the query information to retrieve. For a list of identifiers, see the EVT_QUERY_PROPERTY_ID enumeration.

[in] PropertyValueBufferSize

The size of the PropertyValueBuffer buffer, in bytes.

[in] PropertyValueBuffer

A caller-allocated buffer that will receive the query information. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

[out] PropertyValueBufferUsed

The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

Return value

Return code/value	Description
TRUE	The function succeeded.
FALSE	The function failed. To get the error code, call the GetLastError function.

Remarks

You only need to call this function, if you pass the EvtQueryTolerateQueryErrors flag to EvtQuery or the EvtSubscribeTolerateQueryErrors flag to EvtSubscribe.

Examples

For an example that shows how to use this function, see Querying for Events.

Requirements

Requirement	Value
Minimum supported client	Windows Vista [desktop apps only]
Minimum supported server	Windows Server 2008 [desktop apps only]
Target Platform	Windows
Header	winevt.h
Library	Wevtapi.lib
DLL	Wevtapi.dll

Share via