Solved? Certain Messages hard to get with old Event Log API.. RRS feed

  • Question

  • Hi All,


    I think I found a solution to the problem where certain

    Messages are just hard to get from using FormatMessage() etc.

    using the old Event Log API.


    It's not a 100% solution, but I think it'll help.


    Basically, I think people go off of using Microsoft's sample code

    "Querying for Event Information", which is a good start, but I was having

    difficulty getting certain Messages, until, that is, I finally tried this:


    Some versions of it had, something like:

    dwEventId = (DWORD)((PEVENTLOGRECORD)pRecord)->EventID & 0xFFFF;


    In most cases that will return a good Message, but in some cases it won't.

    By removing the masking you'll end-up with some "strange looking"

    EventIDs, but they'll work!


    EventID: 1073745920

    EventID: -2147482633

    EventID: 1800


    If you look at the some of the Resource DLLs, thay are actually

    defined as the above!


    Hope this helps! :-)


    Friday, July 22, 2011 2:30 PM