c++ - How do I read boot time events on Windows 7? -


i trying use etw functions without success read file c:\windows\system32\winevt\logs\microsoft-windows-diagnostics-performance%4operational.evtx in order capture boot time events. have tried various functions -

  • opentrace gives error 161
  • evtquery gives error 15000

does have native code example of reading system trace files?

i got working follows -

lpwstr pwspath = l"microsoft-windows-diagnostics-performance/operational"; lpwstr pwsquery = l"event/system[eventid=100]";  hresults = evtquery(null, pwspath, pwsquery,                     evtquerychannelpath | evtqueryreversedirection); 

the channel name can found going properties on eventlog , using it's full name.

the error 15000 due me trying open log file given flags rather channel name.


Comments

Popular posts from this blog

SAP Web Service from .NET via WCF -

c# - Getting "Internal .Net Framework Data Provider error 30" error when column has NULL value -

c++ - How to modify context menu of internet explorer using IDocHostUIHandler::ShowContextMenu? -