Edit

Share via

EvtGetLogInfo function (winevt.h)

  • Article

Gets information about a channel or log file.

Syntax

BOOL EvtGetLogInfo(
  [in]  EVT_HANDLE          Log,
  [in]  EVT_LOG_PROPERTY_ID PropertyId,
  [in]  DWORD               PropertyValueBufferSize,
  [in]  PEVT_VARIANT        PropertyValueBuffer,
  [out] PDWORD              PropertyValueBufferUsed
);

Parameters

[in] Log

A handle to the channel or log file that the EvtOpenLog function returns.

[in] PropertyId

The identifier of the property to retrieve. For a list of property identifiers, see the EVT_LOG_PROPERTY_ID enumeration.

[in] PropertyValueBufferSize

The size of the PropertyValueBuffer buffer, in bytes.

[in] PropertyValueBuffer

A caller-allocated buffer that will receive the property value. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

[out] PropertyValueBufferUsed

The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

Return value

Return code/value Description
TRUE
 The function succeeded.
FALSE
 The function failed. To get the error code, call the GetLastError function.

Remarks

You can get complete information for Operational and Admin channels or .evtx files; however, for Debug and Analytic channels or .etl files, you cannot get information for the EvtLogFull, EvtLogOldestRecordNumber, and EvtLogNumberOfLogRecords properties.

Requirements

Requirement Value
Minimum supported client Windows Vista [desktop apps only]
Minimum supported server Windows Server 2008 [desktop apps only]
Target Platform Windows
Header winevt.h
Library Wevtapi.lib
DLL Wevtapi.dll

See also

EvtOpenLog