Peter, you're missing a direction for the read in the dwReadFlags parameter.
ReadEventLog's documentation is unclear. Try:
// ...
const int EVENTLOG_FORWARDS_READ = 0x0004;
// ...
bool success = ReadEventLog(
ibackupLogRetValue,
EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ,
iRecordOffset,
myByteArray,
myByteArray.Length,
out iBytesRead,
out iMinNumberOfBytesNeeded);
On Tue, 26 Apr 2005 09:10:38 -0400, Pete Lutwyche
<[EMAIL PROTECTED]> wrote:
>Thanks all for the help so far. Still struggling, so am posting the test
>app code, as suggested by Peter. Beware the hard coded reference to my
>archived event log - E:\Data\app070105.evt.
>
>using System;
>using System.Diagnostics;
>using System.Runtime.InteropServices;
>
>namespace EventLogConsoleApp
>{
> class EventLogTestApp
> {
> const int EVENTLOG_SEQUENTIAL_READ = 0x0001;
>
> [DllImport("advapi32.dll", EntryPoint="OpenBackupEventLog",
>SetLastError=true)]
> public static extern int OpenBackupEventLog(string
>lpUNCServerName, string lpFileName);
>
> [DllImport("advapi32.dll",
>EntryPoint="GetNumberOfEventLogRecords", SetLastError=true)]
> public static extern int GetNumberOfEventLogRecords(int
>iBackupLogRef, out int iEventCount);
>
> [DllImport("advapi32.dll", EntryPoint="CloseEventLog",
>SetLastError=true)]
> public static extern int CloseEventLog(int iBackupLogRef);
>
> [DllImport("advapi32.dll", EntryPoint="BackupEventLog",
>SetLastError=true)]
> public static extern bool BackupEventLog(int iBackupLogRef,
>string strBackupFileName);
>
> [DllImport("advapi32.dll", EntryPoint="ReadEventLog",
>SetLastError=true)]
> public static extern bool ReadEventLog(
> int iBackupLogRef,
> int dwReadFlags,
> int dwRecordOffset,
> [Out, MarshalAs
>(UnmanagedType.LPArray, ArraySubType=UnmanagedType.LPStruct)] byte[]
>lpBuffer,
> int nNumberOfBytesToRead,
> out int pnBytesRead,
> out int
>pnMinNumberOfBytesNeeded);
>
> /// <summary>
> /// The main entry point for the application.
> /// </summary>
> [STAThread]
> static void Main(string[] args)
> {
> int iLastWin32Error;
>
> // name of the backed up event log
> string strEventLog = "E:\\Data\\app070105.evt";
> byte[] myByteArray = new byte[10048];
>
> // open the event log
> int ibackupLogRetValue = OpenBackupEventLog(null,
>strEventLog);
>
> // get total number of records
> int iEventLogRecordCount;
> int iReturnCode = GetNumberOfEventLogRecords
>(ibackupLogRetValue, out iEventLogRecordCount);
> iLastWin32Error = Marshal.GetLastWin32Error();
> System.Console.WriteLine("The archived event log
>contains " + iEventLogRecordCount + " records");
>
> // get some data from the log
> int iRecordOffset = 0;
> int iBytesRead = 0;
> int iMinNumberOfBytesNeeded = 0;
> bool success = ReadEventLog(
> ibackupLogRetValue,
> EVENTLOG_SEQUENTIAL_READ,
> iRecordOffset,
> myByteArray,
> myByteArray.Length,
> out iBytesRead,
> out iMinNumberOfBytesNeeded);
>
> iLastWin32Error = Marshal.GetLastWin32Error();
>
> string strByteArrayAsString =
>System.Text.ASCIIEncoding.ASCII.GetString(myByteArray);
> System.Console.WriteLine("strByteArrayAsString = "
>+ strByteArrayAsString);
>
> // close the event log
> ibackupLogRetValue = CloseEventLog
>(ibackupLogRetValue);
> }
> }
>}
===================================
This list is hosted by DevelopMentorŪ http://www.develop.com
View archives and manage your subscription(s) at http://discuss.develop.com
