c++ - How do I read boot time events on Windows 7? -
i trying use etw functions without success read file c:\windows\system32\winevt\logs\microsoft-windows-diagnostics-performance%4operational.evtx in order capture boot time events. have tried various functions -
- opentrace gives error 161
- evtquery gives error 15000
does have native code example of reading system trace files?
i got working follows -
lpwstr pwspath = l"microsoft-windows-diagnostics-performance/operational"; lpwstr pwsquery = l"event/system[eventid=100]"; hresults = evtquery(null, pwspath, pwsquery, evtquerychannelpath | evtqueryreversedirection);
the channel name can found going properties on eventlog , using it's full name.
the error 15000 due me trying open log file given flags rather channel name.
Comments
Post a Comment