How to Read the Number of Records from the Eventlog

I attached a small script with an example of how to read the number of records from an event log and how to get the record number of the oldest record in the specified event log.

Computer    = ItemExtract(1,WinSysInfo(),@tab)
dllhandle   = DllLoad(StrCat(DirWindows(1),"advapi32.dll"))
SourceNames = StrCat("Application",@tab,"Security",@tab,"System")  ; If sourcename does not exist, info from the Application log is shown
totallogs   = ItemCount(sourcenames,@tab)


For counter = 1 to totallogs

SourceName = ItemExtract(counter,SourceNames,@tab)

; open a handle to an event log
evthandle = DllCall(dllhandle,LONG:"OpenEventLogA",lpstr:Computer,lpstr:SourceName)

; retrieve the number of records in the specified event log.
buffer = BinaryAlloc(4)
BinaryEodSet(buffer,4)
DllCall(dllhandle,LONG:"GetNumberOfEventLogRecords",long:evthandle,lpbinary:buffer)
number_of_records = BinaryPeek4(buffer,0)
BinaryFree(buffer)

; retrieve the absolute record number of the oldest record in the specified event log.
buffer = BinaryAlloc(4)
BinaryEodSet(buffer,4)
DllCall(dllhandle,LONG:"GetOldestEventLogRecord",long:evthandle,lpbinary:buffer)
oldest_record = BinaryPeek4(buffer,0)
BinaryFree(buffer)

; close a read handle to the specified event log
DllCall(dllhandle,LONG:"CloseEventLog",long:evthandle)

; Show result
Message(StrCat(Sourcename," log"),StrCat("Number of records: ",number_of_records,@crlf,"Oldest record number: ",oldest_record))

Next


; free a loaded dll
DllFree(dllhandle)

Exit

Article ID:   W16007

File Created: 2004:03:30:15:42:10

Last Updated: 2004:03:30:15:42:10

Database Search

TechHome

How to Read the Number of Records from the Eventlog