Java Native Access Platform 5.14.0 · com.sun.jna.platform.win32.Wevtapi

Modifier and Type	Field and Description
public static final Wevtapi	INSTANCE

Modifier and Type	Method and Description
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtArchiveExportedLog(Winevt.EVT_HANDLE [in] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL for local channels. Session, String [in] The full path to the exported log file that contains the events to localize. LogFilePath, int [in] The locale to use to localize the strings that the service adds to the events in the log file. If zero, the function uses the calling thread's locale. If the provider's resources does not contain the locale, the string is empty. Locale, int [in] Reserved. Must be zero. Flags) Adds localized strings to the events in the specified log file.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtCancel(Winevt.EVT_HANDLE The handle whose operation you want to cancel. You can cancel the following operations: `Wevtapi#EvtClearLog` `Wevtapi#EvtExportLog` `Wevtapi#EvtNext` `Wevtapi#EvtQuery` `Wevtapi#EvtSeek` `Wevtapi#EvtSubscribe` To cancel the `Wevtapi#EvtClearLog`, `Wevtapi#EvtExportLog`, `Wevtapi#EvtQuery`, and EvtSubscribe operations, you must pass the session handle. To specify the default session (local session), set this parameter to NULL. Object) Cancels all pending operations on a handle.
public boolean	Returns: True The function was successful, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtClearLog(Winevt.EVT_HANDLE [in, optional] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL for local channels. Session, String [in] The name of the channel to clear. ChannelPath, String [in, optional] The full path to the target log file that will receive the events. Set to NULL to clear the log file and not save the events. TargetFilePath, int [in] Reserved. Must be zero. Flags) Removes all events from the specified channel and writes them to the target log file.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtClose(Winevt.EVT_HANDLE [in] An open event handle to close. Object) Closes an open handle.
public Winevt.EVT_HANDLE	Returns: A handle to the bookmark if the call succeeds; otherwise, NULL. If NULL, call the `Kernel32#GetLastError` function to get the error code. EvtCreateBookmark(String [in, optional] An XML string that contains the bookmark or NULL if creating a bookmark. BookmarkXml) Creates a bookmark that identifies an event in a channel.
public Winevt.EVT_HANDLE	Returns: A context handle that you use when calling the `Wevtapi#EvtRender`function to render the contents of an event; otherwise, NULL. If NULL, call the `Kernel32#GetLastError` function to get the error code. EvtCreateRenderContext(int [in] The number of XPath expressions in the ValuePaths parameter. ValuePathsCount, String[] [in] An array of XPath expressions that uniquely identify a node or attribute in the event that you want to render. The expressions must not contain the OR or AND operator. Set to NULL if the `Winevt.EVT_RENDER_CONTEXT_FLAGS#EvtRenderContextValues` context flag is not set in the Flags parameter. ValuePaths, int [in] One or more flags that identify the information in the event that you want to render. For example, the system information, user information, or specific values. For possible values, see the `Winevt.EVT_RENDER_CONTEXT_FLAGS` enumeration. Flags) Creates a context that specifies the information in the event that you want to render.
public boolean	Returns: True The function was successful, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtExportLog(Winevt.EVT_HANDLE [in, optional] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL for local channels. Session, String [in] The name of the channel or the full path to a log file that contains the events that you want to export. If the Query parameter contains an XPath query, you must specify the channel or log file. If the Flags parameter contains `Winevt.EVT_EXPORTLOG_FLAGS#EvtExportLogFilePath`, you must specify the log file. If the Query parameter contains a structured XML query, the channel or path that you specify here must match the channel or path in the query. If the Flags parameter contains `Winevt.EVT_EXPORTLOG_FLAGS#EvtExportLogChannelPath`, this parameter can be NULL if the query is a structured XML query that specifies the channel. Path, String [in] A query that specifies the types of events that you want to export. You can specify an XPath 1.0 query or structured XML query. If your XPath contains more than 20 expressions, use a structured XML query. To export all events, set this parameter to NULL or "*". Query, String [in] The full path to the target log file that will receive the events. The target log file must not exist. TargetFilePath, int [in] Flags that indicate whether the events come from a channel or log file. For possible values, see the `Winevt.EVT_EXPORTLOG_FLAGS#EvtExportLogChannelPath` enumeration. Flags) Copies events from the specified channel or log file and writes them to the target log file.
public boolean	Returns: True The function was successful, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtFormatMessage(Winevt.EVT_HANDLE [in] A handle to the provider's metadata that the `Wevtapi#EvtOpenPublisherMetadata` function returns. The handle acts as a formatting context for the event or message identifier. You can set this parameter to NULL if the Windows Event Collector service forwarded the event. Forwarded events include a RenderingInfo section that contains the rendered message strings. You can also set this parameter to NULL if the event property that you are formatting is defined in the Winmeta.xml file (for example, if level is set to win:Error). In the latter case, the service uses the Winmeta provider as the formatting context and will format only those message strings that you reference in your event that are defined in the Winmeta.xml file. PublisherMetadata, Winevt.EVT_HANDLE [in] A handle to an event. The Flags parameter specifies the message string in the event that you want to format. This parameter must be NULL if the Flags parameter is set to EvtFormatMessageId. Event, int [in] The resource identifier of the message string that you want to format. To get the resource identifier for a message string, call the `Wevtapi#EvtGetPublisherMetadataProperty` function. Set this parameter only if the Flags parameter is set to EvtFormatMessageId. MessageId, int [in] The number of values in the Values parameter. ValueCount, Winevt.EVT_VARIANT[] [in] An array of insertion values to use when formatting the event's message string. Typically, you set this parameter to NULL and the function gets the insertion values from the event data itself. You would use this parameter to override the default behavior and supply the insertion values to use. For example, you might use this parameter if you wanted to resolve a SID to a principal name before inserting the value. To override the insertion values, the Flags parameter must be set to `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageEvent`, `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageXml`, or `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId`, If Flags is set to `Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId`, the resource identifier must identify the event's message string. Values, int [in] A flag that specifies the message string in the event to format. For possible values, see the `Winevt.EVT_FORMAT_MESSAGE_FLAGS` enumeration. Flags, int [in] The size of the Buffer buffer, in characters. BufferSize, char[] [in] A caller-allocated buffer that will receive the formatted message string. You can set this parameter to NULL to determine the required buffer size. Buffer, IntByReference [out] The size, in characters of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. BufferUsed) Formats a message string.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtGetChannelConfigProperty(Winevt.EVT_HANDLE [in] A handle to the channel's configuration properties that the `Wevtapi#EvtOpenChannelConfig` function returns. ChannelConfig, int [in] The identifier of the channel property to retrieve. For a list of property identifiers, see the `Winevt.EVT_CHANNEL_CONFIG_PROPERTY_ID` enumeration. PropertyId, int [in] Reserved. Must be zero. Flags, int [in] The size of the PropertyValueBuffer buffer, in bytes. PropertyValueBufferSize, Pointer [in] A caller-allocated buffer that will receive the configuration property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size. PropertyValueBuffer, IntByReference [out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. PropertyValueBufferUsed) Gets the specified channel configuration property.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtGetEventInfo(Winevt.EVT_HANDLE [in] A handle to an event for which you want to retrieve information. Event, int [in] A flag that identifies the information to retrieve. For example, the query identifier or the path. For possible values, see the `Winevt.EVT_EVENT_PROPERTY_ID` enumeration. PropertyId, int [in] The size of the PropertyValueBuffer buffer, in bytes. PropertyValueBufferSize, Pointer [in] A caller-allocated buffer that will receive the information. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size. PropertyValueBuffer, IntByReference [in] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. PropertyValueBufferUsed) Gets information that identifies the structured XML query that selected the event and the channel or log file that contained the event.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtGetEventMetadataProperty(Winevt.EVT_HANDLE [in] A handle to the event metadata that the `Wevtapi#EvtNextEventMetadata` function returns. EventMetadata, int [in] The identifier of the metadata property to retrieve. For a list of property identifiers, see the `Winevt.EVT_EVENT_METADATA_PROPERTY_ID` enumeration. PropertyId, int [in] Reserved. Must be zero. Flags, int [in] The size of the EventMetadataPropertyBuffer buffer, in bytes. EventMetadataPropertyBufferSize, Pointer [in] A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size. Buffer, IntByReference [out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. BufferUsed) Gets the specified event metadata property.
public int	Returns: The return value is ERROR_SUCCESS if the call succeeded; otherwise, a Win32 error code. EvtGetExtendedStatus(int [in] The size of the Buffer buffer, in characters. BufferSize, char[] [in] A caller-allocated string buffer that will receive the extended error information. You can set this parameter to NULL to determine the required buffer size. Buffer, IntByReference [out] The size, in characters, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. BufferUsed) Gets a text message that contains the extended error information for the current error.
public boolean	Returns: True The function was successful, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtGetLogInfo(Winevt.EVT_HANDLE [in] A handle to the channel or log file that the `Wevtapi#EvtOpenLog` function returns. Log, int [in] The identifier of the property to retrieve. For a list of property identifiers, see the `Winevt.EVT_LOG_PROPERTY_ID` enumeration. PropertyId, int [in] The size of the PropertyValueBuffer buffer, in bytes. PropertyValueBufferSize, Pointer [in] A caller-allocated buffer that will receive the property value. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size. PropertyValueBuffer, IntByReference [out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. PropertyValueBufferUsed) Gets information about a channel or log file.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtGetObjectArrayProperty(Pointer [in] A handle to an array of objects that the `Wevtapi#EvtGetPublisherMetadataProperty` function returns. ObjectArray, int [in] The property identifier of the metadata property that you want to get from the specified object. For possible values, see the Remarks section of `Winevt.EVT_PUBLISHER_METADATA_PROPERTY_ID`. PropertyId, int [in] The zero-based index of the object in the array. ArrayIndex, int [in] Reserved. Must be zero. Flags, int [in] The size of the PropertyValueBuffer buffer, in bytes. PropertyValueBufferSize, Pointer [in] A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size. PropertyValueBuffer, IntByReference [in] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. PropertyValueBufferUsed) Gets a provider metadata property from the specified object in the array.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtGetObjectArraySize(Pointer [in] A handle to an array of objects that the `Wevtapi#EvtGetPublisherMetadataProperty` function returns. ObjectArray, IntByReference [out] The number of elements in the array. ObjectArraySize) Gets the number of elements in the array of objects.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtGetPublisherMetadataProperty(Winevt.EVT_HANDLE [in] A handle to the metadata that the `Wevtapi#EvtOpenPublisherMetadata` function returns. PublisherMetadata, int [in] The identifier of the metadata property to retrieve. For a list of property identifiers, see the `Winevt.EVT_PUBLISHER_METADATA_PROPERTY_ID` enumeration. PropertyId, int [in] Reserved. Must be zero. Flags, int [in] The size of the PublisherMetadataPropertyBuffer buffer, in bytes. PublisherMetadataPropertyBufferSize, Pointer [in] A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size. PublisherMetadataPropertyBuffer, IntByReference [out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. PublisherMetadataPropertyBufferUsed) Gets the specified provider metadata property.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtGetQueryInfo(Winevt.EVT_HANDLE [in] A handle to the query that the `Wevtapi#EvtQuery` or `Wevtapi#EvtSubscribe` function returns. QueryOrSubscription, int [in] The identifier of the query information to retrieve. For a list of identifiers, see the `Winevt.EVT_QUERY_PROPERTY_ID` enumeration. PropertyId, int [in] The size of the PropertyValueBuffer buffer, in bytes. PropertyValueBufferSize, Pointer [in] A caller-allocated buffer that will receive the query information. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size. PropertyValueBuffer, IntByReference [out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. PropertyValueBufferUsed) Gets information about a query that you ran that identifies the list of channels or log files that the query attempted to access.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtNext(Winevt.EVT_HANDLE [in] The handle to a query or subscription result set that the `Wevtapi#EvtQuery` function or the `Wevtapi#EvtSubscribe` function returns. ResultSet, int [in] The number of elements in the EventArray array. The function will try to retrieve this number of elements from the result set. EventArraySize, Winevt.EVT_HANDLE[] [in] A pointer to an array of handles that will be set to the handles to the events from the result set. EventArray, int [in] The number of milliseconds that you are willing to wait for a result. Set to INFINITE to indicate no time-out value. If the time-out expires, the last error is set to ERROR_TIMEOUT. Timeout, int [in] Reserved. Must be zero. Flags, IntByReference [out] The number of handles in the array that are set. Returned) Gets the next event from the query or subscription results.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtNextChannelPath(Winevt.EVT_HANDLE [in] A handle to the enumerator that the `Wevtapi#EvtOpenChannelEnum` function returns. ChannelEnum, int [in] The size of the ChannelPathBuffer buffer, in characters. ChannelPathBufferSize, char[] [in] A caller-allocated buffer that will receive the name of the channel. You can set this parameter to NULL to determine the required buffer size. ChannelPathBuffer, IntByReference [out] The size, in characters, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. ChannelPathBufferUsed) Gets a channel name from the enumerator.
public Winevt.EVT_HANDLE	Returns: If successful, the function returns a handle to the event's metadata; otherwise, NULL. If NULL, call `Kernel32#GetLastError` function to get the error code. EvtNextEventMetadata(Winevt.EVT_HANDLE [in] A handle to the event definition enumerator that the `Wevtapi#EvtOpenEventMetadataEnum` function returns. EventMetadataEnum, int [in] Reserved. Must be zero. Flags) Gets an event definition from the enumerator.
public boolean	Returns: If successful, the function returns a handle to the list of registered providers; otherwise, NULL. If NULL, call `Kernel32#GetLastError` function to get the error code. EvtNextPublisherId(Winevt.EVT_HANDLE [in] A handle to the registered providers enumerator that the `Wevtapi#EvtOpenPublisherEnum` function returns. PublisherEnum, int [in] The size of the PublisherIdBuffer buffer, in characters. PublisherIdBufferSize, char[] [in] A caller-allocated buffer that will receive the name of the registered provider. You can set this parameter to NULL to determine the required buffer size. PublisherIdBuffer, IntByReference [out] The size, in characters, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. PublisherIdBufferUsed) Gets the identifier of a provider from the enumerator.
public Winevt.EVT_HANDLE	Returns: If successful, the function returns a handle to the channel's configuration; otherwise, NULL. If NULL, call GetLastError function to get the error code. EvtOpenChannelConfig(Winevt.EVT_HANDLE [in] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL to access a channel on the local computer. Session, String [in] The name of the channel to access. ChannelPath, int [in] Reserved. Must be zero. Flags) Gets a handle that you use to read or modify a channel's configuration property.
public Winevt.EVT_HANDLE	Returns: If successful, the function returns a handle to the list of channel names that are registered on the computer; otherwise, NULL. If NULL, call `Kernel32#GetLastError` function to get the error code. EvtOpenChannelEnum(Winevt.EVT_HANDLE [in] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL to enumerate the channels on the local computer. Session, int [in] Reserved. Must be zero. Flags) Gets a handle that you use to enumerate the list of channels that are registered on the computer.
public Winevt.EVT_HANDLE	Returns: If successful, the function returns a handle to the list of events that the provider defines; otherwise, NULL. If NULL, call `Kernel32#GetLastError` function to get the error code. EvtOpenEventMetadataEnum(Winevt.EVT_HANDLE [in] A handle to the provider's metadata that the `Wevtapi#EvtOpenPublisherMetadata` function returns. PublisherMetadata, int [in] Reserved. Must be zero. Flags) Gets a handle that you use to enumerate the list of events that the provider defines.
public Winevt.EVT_HANDLE	Returns: If successful, the function returns a handle to the file or channel; otherwise, NULL. If NULL, call `Kernel32#GetLastError` function to get the error code. EvtOpenLog(Winevt.EVT_HANDLE [in] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL to open a channel or log on the local computer. Session, String [in] The name of the channel or the full path to the exported log file. Path, int [in] A flag that determines whether the Path parameter points to a log file or channel. For possible values, see the `Winevt.EVT_OPEN_LOG_FLAGS` enumeration. Flags) Gets a handle to a channel or log file that you can then use to get information about the channel or log file.
public Winevt.EVT_HANDLE	Returns: If successful, the function returns a handle to the list of registered providers; otherwise, NULL. If NULL, call `Kernel32#GetLastError` function to get the error code. EvtOpenPublisherEnum(Winevt.EVT_HANDLE [in] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL to enumerate the registered providers on the local computer. Session, int [in] Reserved. Must be zero. Flags) Gets a handle that you use to enumerate the list of registered providers on the computer.
public Winevt.EVT_HANDLE	Returns: If successful, the function returns a handle to the provider's metadata; otherwise, NULL. If NULL, call `Kernel32#GetLastError` function to get the error code. EvtOpenPublisherMetadata(Winevt.EVT_HANDLE [in, optional] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL to get the metadata for a provider on the local computer. EvtHandleSession, String [in] The name of the provider. To enumerate the names of the providers registered on the computer, call the `Wevtapi#EvtOpenPublisherEnum` function. PublisherIdentity, String [in, optional] The full path to an archived log file that contains the events that the provider logged. An archived log file also contains the provider's metadata. Use this parameter when the provider is not registered on the local computer. Set to NULL when reading the metadata from a registered provider.. LogFilePath, int [in] The locale identifier to use when accessing the localized metadata from the provider. To create the locale identifier, use the MAKELCID macro. Set to 0 to use the locale identifier of the calling thread. Locale, int [in] Reserved. Must be zero. Flags) Gets a handle that you use to read the specified provider's metadata.
public Winevt.EVT_HANDLE	Returns: If successful, the function returns a session handle that you can use to access event log information on the remote computer; otherwise, NULL. If NULL, call `Kernel32#GetLastError` function to get the error code. EvtOpenSession(int [in] The connection method to use to connect to the remote computer. For possible values, see the `Winevt.EVT_LOGIN_CLASS` enumeration. LoginClass, Winevt.EVT_RPC_LOGIN [in] A EVT_RPC_LOGIN structure that identifies the remote computer that you want to connect to, the user's credentials, and the type of authentication to use when connecting. Login, int [in] Reserved. Must be zero. Timeout, int [in]Reserved. Must be zero. Flags) Establishes a connection to a remote computer that you can use when calling the other Windows Event Log functions.
public Winevt.EVT_HANDLE	Returns: A handle to the query results if successful; otherwise, NULL. If the function returns NULL, call the `Kernel32#GetLastError` function to get the error code. EvtQuery(Winevt.EVT_HANDLE [in] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL to query for events on the local computer. Session, String [in] The name of the channel or the full path to a log file that contains the events that you want to query. You can specify an .evt, .evtx, or.etl log file. The path is required if the Query parameter contains an XPath query; the path is ignored if the Query parameter contains a structured XML query and the query specifies the path. Path, String [in] A query that specifies the types of events that you want to retrieve. You can specify an XPath 1.0 query or structured XML query. If your XPath contains more than 20 expressions, use a structured XML query. To receive all events, set this parameter to NULL or "*". Query, int [in] One or more flags that specify the order that you want to receive the events and whether you are querying against a channel or log file. For possible values, see the `Winevt.EVT_QUERY_FLAGS` enumeration. Flags) Runs a query to retrieve events from a channel or log file that match the specified query criteria.
public boolean	Returns: True The function was successful, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtRender(Winevt.EVT_HANDLE [in] A handle to the rendering context that the `Wevtapi#EvtCreateRenderContext` function returns. This parameter must be set to NULL if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml` or `Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark`. Context, Winevt.EVT_HANDLE [in] A handle to an event or to a bookmark. Set this parameter to a bookmark handle if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml`; otherwise, set to an event handle. Fragment, int [in] A flag that identifies what to render. For example, the entire event or specific properties of the event. For possible values,see the `Winevt.EVT_RENDER_FLAGS` enumeration. Flags, int [in] The size of the Buffer buffer, in bytes. BufferSize, Pointer [in] A caller-allocated buffer that will receive the rendered output. The contents is a null-terminated Unicode string if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml` or `Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark`. Otherwise, if Flags is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues`, the buffer contains an array of EVT_VARIANT structures; one for each property specified by the rendering context. The PropertyCount parameter contains the number of elements in the array. Buffer, IntByReference [out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER. BufferUsed, IntByReference [out] The number of the properties in the Buffer parameter if the Flags parameter is set to `Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues`; otherwise, zero. PropertyCount) Renders an XML fragment based on the rendering context that you specify.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtSaveChannelConfig(Winevt.EVT_HANDLE [in] A handle to the channel's configuration properties that the `Wevtapi#EvtOpenChannelConfig` function returns. ChannelConfig, int [in] Reserved. Must be zero. Flags) Saves the changes made to a channel's configuration.
public boolean	Returns: True The function was successful, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtSeek(Winevt.EVT_HANDLE [in] The handle to a query result set that the `Wevtapi#EvtQuery` function returns. ResultSet, long [in] The zero-based offset to an event in the result set. The flag that you specify in the Flags parameter indicates the beginning relative position in the result set from which to seek. For example, you can seek from the beginning of the results or from the end of the results. Set to 0 to move to the relative position specified by the flag. Position, Winevt.EVT_HANDLE [in] A handle to a bookmark that the `Wevtapi#EvtCreateBookmark`function returns. The bookmark identifies an event in the result set to which you want to seek. Set this parameter only if the Flags parameter has the EvtSeekRelativeToBookmark flag set. Bookmark, int [in] Reserved. Must be zero. Timeout, int [in] One or more flags that indicate the relative position in the result set from which to seek. For possible values, see the `Winevt.EVT_SEEK_FLAGS` enumeration. Flags) Seeks to a specific event in a query result set.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtSetChannelConfigProperty(Winevt.EVT_HANDLE [in] A handle to the channel's configuration properties that the `Wevtapi#EvtOpenChannelConfig` function returns. ChannelConfig, int [in] The identifier of the channel property to set. For a list of property identifiers, see the `Winevt.EVT_CHANNEL_CONFIG_PROPERTY_ID` enumeration. PropertyId, int [in] Reserved. Must be zero. Flags, Winevt.EVT_VARIANT [in] The property value to set. A caller-allocated buffer that contains the new configuration property value. The buffer contains an EVT_VARIANT object. Be sure to set the configuration value and variant type. PropertyValue) Sets the specified configuration property of a channel.
public Winevt.EVT_HANDLE	Returns: A handle to the subscription if successful; otherwise, NULL. If the function returns NULL, call the `Kernel32#GetLastError` function to get the error code. You must call the EvtClose function with the subscription handle when done. EvtSubscribe(Winevt.EVT_HANDLE [in] A remote session handle that the `Wevtapi#EvtOpenSession` function returns. Set to NULL to subscribe to events on the local computer. Session, Winevt.EVT_HANDLE [in] The handle to an event object that the service will signal when new events are available that match your query criteria. This parameter must be NULL if the Callback parameter is not NULL. SignalEvent, String [in] The name of the Admin or Operational channel that contains the events that you want to subscribe to (you cannot subscribe to Analytic or Debug channels). The path is required if the Query parameter contains an XPath query; the path is ignored if the Query parameter contains a structured XML query. ChannelPath, String [in] A query that specifies the types of events that you want the subscription service to return. You can specify an XPath 1.0 query or structured XML query. If your XPath contains more than 20 expressions, use a structured XML query. To receive all events, set this parameter to NULL or "*". Query, Winevt.EVT_HANDLE [in] A handle to a bookmark that identifies the starting point for the subscription. To get a bookmark handle, call the `Wevtapi#EvtCreateBookmark` function. You must set this parameter if the Flags parameter contains the EvtSubscribeStartAfterBookmark flag; otherwise, NULL. Bookmark, Pointer [in] A caller-defined context value that the subscription service will pass to the specified callback each time it delivers an event. Context, Callback [in] Pointer to your EVT_SUBSCRIBE_CALLBACK callback function that will receive the subscription events. This parameter must be NULL if the SignalEvent parameter is not NULL. Callback, int [in] One or more flags that specify when to start subscribing to events. For example, if you specify `Winevt.EVT_SUBSCRIBE_FLAGS#EvtSubscribeStartAtOldestRecord`, the service will retrieve all current and future events that match your query criteria; however, if you specify `Winevt.EVT_SUBSCRIBE_FLAGS#EvtSubscribeToFutureEvents`, the service returns only future events that match your query criteria. For possible values,see the `Winevt.EVT_SUBSCRIBE_FLAGS` enumeration. Flags) Creates a subscription that will receive current and future events from a channel or log file that match the specified query criteria.
public boolean	Returns: True The function succeeded, False The function failed. To get the error code, call the `Kernel32#GetLastError` function. EvtUpdateBookmark(Winevt.EVT_HANDLE [in] The handle to the bookmark to be updated. The `Wevtapi#EvtCreateBookmark` function returns this handle. Bookmark, Winevt.EVT_HANDLE [in] The handle to the event to bookmark. Event) Updates the bookmark with information that identifies the specified event.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtArchiveExportedLog(Winevt.EVT_HANDLE

[in] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL for local channels.

Session, String

[in] The full path to the exported log file that contains the events to localize.

LogFilePath, int

[in] The locale to use to localize the strings that the service adds to the events in the log file. If zero, the function uses the calling thread's locale. If the provider's resources does not contain the locale, the string is empty.

Locale, int

[in] Reserved. Must be zero.

Flags)

Adds localized strings to the events in the specified log file.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtCancel(Winevt.EVT_HANDLE

The handle whose operation you want to cancel. You can cancel the following operations:

To cancel the Wevtapi#EvtClearLog, Wevtapi#EvtExportLog, Wevtapi#EvtQuery, and EvtSubscribe operations, you must pass the session handle. To specify the default session (local session), set this parameter to NULL.

Object)

Cancels all pending operations on a handle.

public boolean

Returns:

True The function was successful, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtClearLog(Winevt.EVT_HANDLE

[in, optional] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL for local channels.

Session, String

[in] The name of the channel to clear.

ChannelPath, String

[in, optional] The full path to the target log file that will receive the events. Set to NULL to clear the log file and not save the events.

TargetFilePath, int

[in] Reserved. Must be zero.

Flags)

Removes all events from the specified channel and writes them to the target log file.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtClose(Winevt.EVT_HANDLE

[in] An open event handle to close.

Object)

Closes an open handle.

public Winevt.EVT_HANDLE

Returns:

A handle to the bookmark if the call succeeds; otherwise, NULL. If NULL, call the Kernel32#GetLastError function to get the error code.

EvtCreateBookmark(String

[in, optional] An XML string that contains the bookmark or NULL if creating a bookmark.

BookmarkXml)

Creates a bookmark that identifies an event in a channel.

public Winevt.EVT_HANDLE

Returns:

A context handle that you use when calling the Wevtapi#EvtRenderfunction to render the contents of an event; otherwise, NULL. If NULL, call the Kernel32#GetLastError function to get the error code.

EvtCreateRenderContext(int

[in] The number of XPath expressions in the ValuePaths parameter.

ValuePathsCount, String[]

[in] An array of XPath expressions that uniquely identify a node or attribute in the event that you want to render. The expressions must not contain the OR or AND operator. Set to NULL if the Winevt.EVT_RENDER_CONTEXT_FLAGS#EvtRenderContextValues context flag is not set in the Flags parameter.

ValuePaths, int

[in] One or more flags that identify the information in the event that you want to render. For example, the system information, user information, or specific values. For possible values, see the Winevt.EVT_RENDER_CONTEXT_FLAGS enumeration.

Flags)

Creates a context that specifies the information in the event that you want to render.

public boolean

Returns:

True The function was successful, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtExportLog(Winevt.EVT_HANDLE

[in, optional] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL for local channels.

Session, String

[in] The name of the channel or the full path to a log file that contains the events that you want to export. If the Query parameter contains an XPath query, you must specify the channel or log file. If the Flags parameter contains Winevt.EVT_EXPORTLOG_FLAGS#EvtExportLogFilePath, you must specify the log file. If the Query parameter contains a structured XML query, the channel or path that you specify here must match the channel or path in the query. If the Flags parameter contains Winevt.EVT_EXPORTLOG_FLAGS#EvtExportLogChannelPath, this parameter can be NULL if the query is a structured XML query that specifies the channel.

Path, String

[in] A query that specifies the types of events that you want to export. You can specify an XPath 1.0 query or structured XML query. If your XPath contains more than 20 expressions, use a structured XML query. To export all events, set this parameter to NULL or "*".

Query, String

[in] The full path to the target log file that will receive the events. The target log file must not exist.

TargetFilePath, int

[in] Flags that indicate whether the events come from a channel or log file. For possible values, see the Winevt.EVT_EXPORTLOG_FLAGS#EvtExportLogChannelPath enumeration.

Flags)

Copies events from the specified channel or log file and writes them to the target log file.

public boolean

Returns:

True The function was successful, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtFormatMessage(Winevt.EVT_HANDLE

[in] A handle to the provider's metadata that the Wevtapi#EvtOpenPublisherMetadata function returns. The handle acts as a formatting context for the event or message identifier.

You can set this parameter to NULL if the Windows Event Collector service forwarded the event. Forwarded events include a RenderingInfo section that contains the rendered message strings. You can also set this parameter to NULL if the event property that you are formatting is defined in the Winmeta.xml file (for example, if level is set to win:Error). In the latter case, the service uses the Winmeta provider as the formatting context and will format only those message strings that you reference in your event that are defined in the Winmeta.xml file.

PublisherMetadata, Winevt.EVT_HANDLE

[in] A handle to an event. The Flags parameter specifies the message string in the event that you want to format. This parameter must be NULL if the Flags parameter is set to EvtFormatMessageId.

Event, int

[in] The resource identifier of the message string that you want to format. To get the resource identifier for a message string, call the Wevtapi#EvtGetPublisherMetadataProperty function. Set this parameter only if the Flags parameter is set to EvtFormatMessageId.

MessageId, int

[in] The number of values in the Values parameter.

ValueCount, Winevt.EVT_VARIANT[]

[in] An array of insertion values to use when formatting the event's message string. Typically, you set this parameter to NULL and the function gets the insertion values from the event data itself. You would use this parameter to override the default behavior and supply the insertion values to use. For example, you might use this parameter if you wanted to resolve a SID to a principal name before inserting the value.

To override the insertion values, the Flags parameter must be set to Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageEvent, Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageXml, or Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId, If Flags is set to Winevt.EVT_FORMAT_MESSAGE_FLAGS#EvtFormatMessageId, the resource identifier must identify the event's message string.

Values, int

[in] A flag that specifies the message string in the event to format. For possible values, see the Winevt.EVT_FORMAT_MESSAGE_FLAGS enumeration.

Flags, int

[in] The size of the Buffer buffer, in characters.

BufferSize, char[]

[in] A caller-allocated buffer that will receive the formatted message string. You can set this parameter to NULL to determine the required buffer size.

Buffer, IntByReference

[out] The size, in characters of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

BufferUsed)

Formats a message string.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtGetChannelConfigProperty(Winevt.EVT_HANDLE

[in] A handle to the channel's configuration properties that the Wevtapi#EvtOpenChannelConfig function returns.

ChannelConfig, int

[in] The identifier of the channel property to retrieve. For a list of property identifiers, see the Winevt.EVT_CHANNEL_CONFIG_PROPERTY_ID enumeration.

PropertyId, int

[in] Reserved. Must be zero.

Flags, int

[in] The size of the PropertyValueBuffer buffer, in bytes.

PropertyValueBufferSize, Pointer

[in] A caller-allocated buffer that will receive the configuration property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

PropertyValueBuffer, IntByReference

[out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

PropertyValueBufferUsed)

Gets the specified channel configuration property.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtGetEventInfo(Winevt.EVT_HANDLE

[in] A handle to an event for which you want to retrieve information.

Event, int

[in] A flag that identifies the information to retrieve. For example, the query identifier or the path. For possible values, see the Winevt.EVT_EVENT_PROPERTY_ID enumeration.

PropertyId, int

[in] The size of the PropertyValueBuffer buffer, in bytes.

PropertyValueBufferSize, Pointer

[in] A caller-allocated buffer that will receive the information. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

PropertyValueBuffer, IntByReference

[in] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

PropertyValueBufferUsed)

Gets information that identifies the structured XML query that selected the event and the channel or log file that contained the event.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtGetEventMetadataProperty(Winevt.EVT_HANDLE

[in] A handle to the event metadata that the Wevtapi#EvtNextEventMetadata function returns.

EventMetadata, int

[in] The identifier of the metadata property to retrieve. For a list of property identifiers, see the Winevt.EVT_EVENT_METADATA_PROPERTY_ID enumeration.

PropertyId, int

[in] Reserved. Must be zero.

Flags, int

[in] The size of the EventMetadataPropertyBuffer buffer, in bytes.

EventMetadataPropertyBufferSize, Pointer

[in] A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

Buffer, IntByReference

[out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

BufferUsed)

Gets the specified event metadata property.

public int

Returns:

The return value is ERROR_SUCCESS if the call succeeded; otherwise, a Win32 error code.

EvtGetExtendedStatus(int

[in] The size of the Buffer buffer, in characters.

BufferSize, char[]

[in] A caller-allocated string buffer that will receive the extended error information. You can set this parameter to NULL to determine the required buffer size.

Buffer, IntByReference

[out] The size, in characters, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

BufferUsed)

Gets a text message that contains the extended error information for the current error.

public boolean

Returns:

True The function was successful, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtGetLogInfo(Winevt.EVT_HANDLE

[in] A handle to the channel or log file that the Wevtapi#EvtOpenLog function returns.

Log, int

[in] The identifier of the property to retrieve. For a list of property identifiers, see the Winevt.EVT_LOG_PROPERTY_ID enumeration.

PropertyId, int

[in] The size of the PropertyValueBuffer buffer, in bytes.

PropertyValueBufferSize, Pointer

[in] A caller-allocated buffer that will receive the property value. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

PropertyValueBuffer, IntByReference

[out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

PropertyValueBufferUsed)

Gets information about a channel or log file.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtGetObjectArrayProperty(Pointer

[in] A handle to an array of objects that the Wevtapi#EvtGetPublisherMetadataProperty function returns.

ObjectArray, int

[in] The property identifier of the metadata property that you want to get from the specified object. For possible values, see the Remarks section of Winevt.EVT_PUBLISHER_METADATA_PROPERTY_ID.

PropertyId, int

[in] The zero-based index of the object in the array.

ArrayIndex, int

[in] Reserved. Must be zero.

Flags, int

[in] The size of the PropertyValueBuffer buffer, in bytes.

PropertyValueBufferSize, Pointer

[in] A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

PropertyValueBuffer, IntByReference

[in] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

PropertyValueBufferUsed)

Gets a provider metadata property from the specified object in the array.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtGetObjectArraySize(Pointer

[in] A handle to an array of objects that the Wevtapi#EvtGetPublisherMetadataProperty function returns.

ObjectArray, IntByReference

[out] The number of elements in the array.

ObjectArraySize)

Gets the number of elements in the array of objects.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtGetPublisherMetadataProperty(Winevt.EVT_HANDLE

[in] A handle to the metadata that the Wevtapi#EvtOpenPublisherMetadata function returns.

PublisherMetadata, int

[in] The identifier of the metadata property to retrieve. For a list of property identifiers, see the Winevt.EVT_PUBLISHER_METADATA_PROPERTY_ID enumeration.

PropertyId, int

[in] Reserved. Must be zero.

Flags, int

[in] The size of the PublisherMetadataPropertyBuffer buffer, in bytes.

PublisherMetadataPropertyBufferSize, Pointer

[in] A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

PublisherMetadataPropertyBuffer, IntByReference

[out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

PublisherMetadataPropertyBufferUsed)

Gets the specified provider metadata property.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtGetQueryInfo(Winevt.EVT_HANDLE

[in] A handle to the query that the Wevtapi#EvtQuery or Wevtapi#EvtSubscribe function returns.

QueryOrSubscription, int

[in] The identifier of the query information to retrieve. For a list of identifiers, see the Winevt.EVT_QUERY_PROPERTY_ID enumeration.

PropertyId, int

[in] The size of the PropertyValueBuffer buffer, in bytes.

PropertyValueBufferSize, Pointer

[in] A caller-allocated buffer that will receive the query information. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

PropertyValueBuffer, IntByReference

[out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

PropertyValueBufferUsed)

Gets information about a query that you ran that identifies the list of channels or log files that the query attempted to access.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtNext(Winevt.EVT_HANDLE

[in] The handle to a query or subscription result set that the Wevtapi#EvtQuery function or the Wevtapi#EvtSubscribe function returns.

ResultSet, int

[in] The number of elements in the EventArray array. The function will try to retrieve this number of elements from the result set.

EventArraySize, Winevt.EVT_HANDLE[]

[in] A pointer to an array of handles that will be set to the handles to the events from the result set.

EventArray, int

[in] The number of milliseconds that you are willing to wait for a result. Set to INFINITE to indicate no time-out value. If the time-out expires, the last error is set to ERROR_TIMEOUT.

Timeout, int

[in] Reserved. Must be zero.

Flags, IntByReference

[out] The number of handles in the array that are set.

Returned)

Gets the next event from the query or subscription results.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtNextChannelPath(Winevt.EVT_HANDLE

[in] A handle to the enumerator that the Wevtapi#EvtOpenChannelEnum function returns.

ChannelEnum, int

[in] The size of the ChannelPathBuffer buffer, in characters.

ChannelPathBufferSize, char[]

[in] A caller-allocated buffer that will receive the name of the channel. You can set this parameter to NULL to determine the required buffer size.

ChannelPathBuffer, IntByReference

[out] The size, in characters, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

ChannelPathBufferUsed)

Gets a channel name from the enumerator.

public Winevt.EVT_HANDLE

Returns:

If successful, the function returns a handle to the event's metadata; otherwise, NULL. If NULL, call Kernel32#GetLastError function to get the error code.

EvtNextEventMetadata(Winevt.EVT_HANDLE

[in] A handle to the event definition enumerator that the Wevtapi#EvtOpenEventMetadataEnum function returns.

EventMetadataEnum, int

[in] Reserved. Must be zero.

Flags)

Gets an event definition from the enumerator.

public boolean

Returns:

If successful, the function returns a handle to the list of registered providers; otherwise, NULL. If NULL, call Kernel32#GetLastError function to get the error code.

EvtNextPublisherId(Winevt.EVT_HANDLE

[in] A handle to the registered providers enumerator that the Wevtapi#EvtOpenPublisherEnum function returns.

PublisherEnum, int

[in] The size of the PublisherIdBuffer buffer, in characters.

PublisherIdBufferSize, char[]

[in] A caller-allocated buffer that will receive the name of the registered provider. You can set this parameter to NULL to determine the required buffer size.

PublisherIdBuffer, IntByReference

[out] The size, in characters, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

PublisherIdBufferUsed)

Gets the identifier of a provider from the enumerator.

public Winevt.EVT_HANDLE

Returns:

If successful, the function returns a handle to the channel's configuration; otherwise, NULL. If NULL, call GetLastError function to get the error code.

EvtOpenChannelConfig(Winevt.EVT_HANDLE

[in] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL to access a channel on the local computer.

Session, String

[in] The name of the channel to access.

ChannelPath, int

[in] Reserved. Must be zero.

Flags)

Gets a handle that you use to read or modify a channel's configuration property.

public Winevt.EVT_HANDLE

Returns:

If successful, the function returns a handle to the list of channel names that are registered on the computer; otherwise, NULL. If NULL, call Kernel32#GetLastError function to get the error code.

EvtOpenChannelEnum(Winevt.EVT_HANDLE

[in] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL to enumerate the channels on the local computer.

Session, int

[in] Reserved. Must be zero.

Flags)

Gets a handle that you use to enumerate the list of channels that are registered on the computer.

public Winevt.EVT_HANDLE

Returns:

If successful, the function returns a handle to the list of events that the provider defines; otherwise, NULL. If NULL, call Kernel32#GetLastError function to get the error code.

EvtOpenEventMetadataEnum(Winevt.EVT_HANDLE

[in] A handle to the provider's metadata that the Wevtapi#EvtOpenPublisherMetadata function returns.

PublisherMetadata, int

[in] Reserved. Must be zero.

Flags)

Gets a handle that you use to enumerate the list of events that the provider defines.

public Winevt.EVT_HANDLE

Returns:

If successful, the function returns a handle to the file or channel; otherwise, NULL. If NULL, call Kernel32#GetLastError function to get the error code.

EvtOpenLog(Winevt.EVT_HANDLE

[in] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL to open a channel or log on the local computer.

Session, String

[in] The name of the channel or the full path to the exported log file.

Path, int

[in] A flag that determines whether the Path parameter points to a log file or channel. For possible values, see the Winevt.EVT_OPEN_LOG_FLAGS enumeration.

Flags)

Gets a handle to a channel or log file that you can then use to get information about the channel or log file.

public Winevt.EVT_HANDLE

Returns:

If successful, the function returns a handle to the list of registered providers; otherwise, NULL. If NULL, call Kernel32#GetLastError function to get the error code.

EvtOpenPublisherEnum(Winevt.EVT_HANDLE

[in] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL to enumerate the registered providers on the local computer.

Session, int

[in] Reserved. Must be zero.

Flags)

Gets a handle that you use to enumerate the list of registered providers on the computer.

public Winevt.EVT_HANDLE

Returns:

If successful, the function returns a handle to the provider's metadata; otherwise, NULL. If NULL, call Kernel32#GetLastError function to get the error code.

EvtOpenPublisherMetadata(Winevt.EVT_HANDLE

[in, optional] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL to get the metadata for a provider on the local computer.

EvtHandleSession, String

[in] The name of the provider. To enumerate the names of the providers registered on the computer, call the Wevtapi#EvtOpenPublisherEnum function.

PublisherIdentity, String

[in, optional] The full path to an archived log file that contains the events that the provider logged. An archived log file also contains the provider's metadata. Use this parameter when the provider is not registered on the local computer. Set to NULL when reading the metadata from a registered provider..

LogFilePath, int

[in] The locale identifier to use when accessing the localized metadata from the provider. To create the locale identifier, use the MAKELCID macro. Set to 0 to use the locale identifier of the calling thread.

Locale, int

[in] Reserved. Must be zero.

Flags)

Gets a handle that you use to read the specified provider's metadata.

public Winevt.EVT_HANDLE

Returns:

If successful, the function returns a session handle that you can use to access event log information on the remote computer; otherwise, NULL. If NULL, call Kernel32#GetLastError function to get the error code.

EvtOpenSession(int

[in] The connection method to use to connect to the remote computer. For possible values, see the Winevt.EVT_LOGIN_CLASS enumeration.

LoginClass, Winevt.EVT_RPC_LOGIN

[in] A EVT_RPC_LOGIN structure that identifies the remote computer that you want to connect to, the user's credentials, and the type of authentication to use when connecting.

Login, int

[in] Reserved. Must be zero.

Timeout, int

[in]Reserved. Must be zero.

Flags)

Establishes a connection to a remote computer that you can use when calling the other Windows Event Log functions.

public Winevt.EVT_HANDLE

Returns:

A handle to the query results if successful; otherwise, NULL. If the function returns NULL, call the Kernel32#GetLastError function to get the error code.

EvtQuery(Winevt.EVT_HANDLE

[in] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL to query for events on the local computer.

Session, String

[in] The name of the channel or the full path to a log file that contains the events that you want to query. You can specify an .evt, .evtx, or.etl log file. The path is required if the Query parameter contains an XPath query; the path is ignored if the Query parameter contains a structured XML query and the query specifies the path.

Path, String

[in] A query that specifies the types of events that you want to retrieve. You can specify an XPath 1.0 query or structured XML query. If your XPath contains more than 20 expressions, use a structured XML query. To receive all events, set this parameter to NULL or "*".

Query, int

[in] One or more flags that specify the order that you want to receive the events and whether you are querying against a channel or log file. For possible values, see the Winevt.EVT_QUERY_FLAGS enumeration.

Flags)

Runs a query to retrieve events from a channel or log file that match the specified query criteria.

public boolean

Returns:

True The function was successful, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtRender(Winevt.EVT_HANDLE

[in] A handle to the rendering context that the Wevtapi#EvtCreateRenderContext function returns. This parameter must be set to NULL if the Flags parameter is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml or Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark.

Context, Winevt.EVT_HANDLE

[in] A handle to an event or to a bookmark. Set this parameter to a bookmark handle if the Flags parameter is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml; otherwise, set to an event handle.

Fragment, int

[in] A flag that identifies what to render. For example, the entire event or specific properties of the event. For possible values,see the Winevt.EVT_RENDER_FLAGS enumeration.

Flags, int

[in] The size of the Buffer buffer, in bytes.

BufferSize, Pointer

[in] A caller-allocated buffer that will receive the rendered output. The contents is a null-terminated Unicode string if the Flags parameter is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventXml or Winevt.EVT_RENDER_FLAGS#EvtRenderBookmark. Otherwise, if Flags is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues, the buffer contains an array of EVT_VARIANT structures; one for each property specified by the rendering context. The PropertyCount parameter contains the number of elements in the array.

Buffer, IntByReference

[out] The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

BufferUsed, IntByReference

[out] The number of the properties in the Buffer parameter if the Flags parameter is set to Winevt.EVT_RENDER_FLAGS#EvtRenderEventValues; otherwise, zero.

PropertyCount)

Renders an XML fragment based on the rendering context that you specify.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtSaveChannelConfig(Winevt.EVT_HANDLE

[in] A handle to the channel's configuration properties that the Wevtapi#EvtOpenChannelConfig function returns.

ChannelConfig, int

[in] Reserved. Must be zero.

Flags)

Saves the changes made to a channel's configuration.

public boolean

Returns:

True The function was successful, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtSeek(Winevt.EVT_HANDLE

[in] The handle to a query result set that the Wevtapi#EvtQuery function returns.

ResultSet, long

[in] The zero-based offset to an event in the result set. The flag that you specify in the Flags parameter indicates the beginning relative position in the result set from which to seek. For example, you can seek from the beginning of the results or from the end of the results. Set to 0 to move to the relative position specified by the flag.

Position, Winevt.EVT_HANDLE

[in] A handle to a bookmark that the Wevtapi#EvtCreateBookmarkfunction returns. The bookmark identifies an event in the result set to which you want to seek. Set this parameter only if the Flags parameter has the EvtSeekRelativeToBookmark flag set.

Bookmark, int

[in] Reserved. Must be zero.

Timeout, int

[in] One or more flags that indicate the relative position in the result set from which to seek. For possible values, see the Winevt.EVT_SEEK_FLAGS enumeration.

Flags)

Seeks to a specific event in a query result set.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtSetChannelConfigProperty(Winevt.EVT_HANDLE

[in] A handle to the channel's configuration properties that the Wevtapi#EvtOpenChannelConfig function returns.

ChannelConfig, int

[in] The identifier of the channel property to set. For a list of property identifiers, see the Winevt.EVT_CHANNEL_CONFIG_PROPERTY_ID enumeration.

PropertyId, int

[in] Reserved. Must be zero.

Flags, Winevt.EVT_VARIANT

[in] The property value to set. A caller-allocated buffer that contains the new configuration property value. The buffer contains an EVT_VARIANT object. Be sure to set the configuration value and variant type.

PropertyValue)

Sets the specified configuration property of a channel.

public Winevt.EVT_HANDLE

Returns:

A handle to the subscription if successful; otherwise, NULL. If the function returns NULL, call the Kernel32#GetLastError function to get the error code. You must call the EvtClose function with the subscription handle when done.

EvtSubscribe(Winevt.EVT_HANDLE

[in] A remote session handle that the Wevtapi#EvtOpenSession function returns. Set to NULL to subscribe to events on the local computer.

Session, Winevt.EVT_HANDLE

[in] The handle to an event object that the service will signal when new events are available that match your query criteria. This parameter must be NULL if the Callback parameter is not NULL.

SignalEvent, String

[in] The name of the Admin or Operational channel that contains the events that you want to subscribe to (you cannot subscribe to Analytic or Debug channels). The path is required if the Query parameter contains an XPath query; the path is ignored if the Query parameter contains a structured XML query.

ChannelPath, String

[in] A query that specifies the types of events that you want the subscription service to return. You can specify an XPath 1.0 query or structured XML query. If your XPath contains more than 20 expressions, use a structured XML query. To receive all events, set this parameter to NULL or "*".

Query, Winevt.EVT_HANDLE

[in] A handle to a bookmark that identifies the starting point for the subscription. To get a bookmark handle, call the Wevtapi#EvtCreateBookmark function. You must set this parameter if the Flags parameter contains the EvtSubscribeStartAfterBookmark flag; otherwise, NULL.

Bookmark, Pointer

[in] A caller-defined context value that the subscription service will pass to the specified callback each time it delivers an event.

Context, Callback

[in] Pointer to your EVT_SUBSCRIBE_CALLBACK callback function that will receive the subscription events. This parameter must be NULL if the SignalEvent parameter is not NULL.

Callback, int

[in] One or more flags that specify when to start subscribing to events. For example, if you specify Winevt.EVT_SUBSCRIBE_FLAGS#EvtSubscribeStartAtOldestRecord, the service will retrieve all current and future events that match your query criteria; however, if you specify Winevt.EVT_SUBSCRIBE_FLAGS#EvtSubscribeToFutureEvents, the service returns only future events that match your query criteria. For possible values,see the Winevt.EVT_SUBSCRIBE_FLAGS enumeration.

Flags)

Creates a subscription that will receive current and future events from a channel or log file that match the specified query criteria.

public boolean

Returns:

True The function succeeded, False The function failed. To get the error code, call the Kernel32#GetLastError function.

EvtUpdateBookmark(Winevt.EVT_HANDLE

[in] The handle to the bookmark to be updated. The Wevtapi#EvtCreateBookmark function returns this handle.

Bookmark, Winevt.EVT_HANDLE

[in] The handle to the event to bookmark.

Event)

Updates the bookmark with information that identifies the specified event.

public Interface Wevtapi

Field Summary

Method Summary