locked
Solved? Certain Messages hard to get with old Event Log API.. RRS feed

  • Question

  • Hi All,

     

    I think I found a solution to the problem where certain

    Messages are just hard to get from using FormatMessage() etc.

    using the old Event Log API.

     

    It's not a 100% solution, but I think it'll help.

     

    Basically, I think people go off of using Microsoft's sample code

    "Querying for Event Information", which is a good start, but I was having

    difficulty getting certain Messages, until, that is, I finally tried this:

     

    Some versions of it had, something like:

    dwEventId = (DWORD)((PEVENTLOGRECORD)pRecord)->EventID & 0xFFFF;

     

    In most cases that will return a good Message, but in some cases it won't.

    By removing the masking you'll end-up with some "strange looking"

    EventIDs, but they'll work!

     

    EventID: 1073745920

    EventID: -2147482633

    EventID: 1800

     

    If you look at the some of the Resource DLLs, thay are actually

    defined as the above!

     

    Hope this helps! :-)

     

    Friday, July 22, 2011 2:30 PM