c++ - How do I read boot time events on Windows 7? -


i trying use etw functions without success read file c:\windows\system32\winevt\logs\microsoft-windows-diagnostics-performance%4operational.evtx in order capture boot time events. have tried various functions -

  • opentrace gives error 161
  • evtquery gives error 15000

does have native code example of reading system trace files?

i got working follows -

lpwstr pwspath = l"microsoft-windows-diagnostics-performance/operational"; lpwstr pwsquery = l"event/system[eventid=100]";  hresults = evtquery(null, pwspath, pwsquery,                     evtquerychannelpath | evtqueryreversedirection); 

the channel name can found going properties on eventlog , using it's full name.

the error 15000 due me trying open log file given flags rather channel name.


Comments

Popular posts from this blog

android - Spacing between the stars of a rating bar? -

aspxgridview - Devexpress grid - header filter does not work if column is initially hidden -

c# - How to execute a particular part of code asynchronously in a class -