EVENTLOGRECORD

構造体

サイズx64: 56 バイト / x86: 56 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド	型	サイズ	x64	x86	説明
Length	DWORD	4	+0	+0	本レコード全体のバイト長。
Reserved	DWORD	4	+4	+4	イベントログの署名を示す予約値。
RecordNumber	DWORD	4	+8	+8	ログ内でのレコード番号。
TimeGenerated	DWORD	4	+12	+12	イベント生成時刻(1970年起点の秒数)。
TimeWritten	DWORD	4	+16	+16	ログ書き込み時刻(1970年起点の秒数)。
EventID	DWORD	4	+20	+20	イベントを識別するID。
EventType	REPORT_EVENT_TYPE	2	+24	+24	イベントの種類(REPORT_EVENT_TYPE、エラー/警告等)。
NumStrings	WORD	2	+26	+26	挿入文字列の数。
EventCategory	WORD	2	+28	+28	イベントのカテゴリ。
ReservedFlags	WORD	2	+30	+30	予約フラグ。
ClosingRecordNumber	DWORD	4	+32	+32	予約フィールド(クローズレコード番号)。
StringOffset	DWORD	4	+36	+36	挿入文字列群へのバイトオフセット。
UserSidLength	DWORD	4	+40	+40	ユーザーSIDのバイト長。0で無し。
UserSidOffset	DWORD	4	+44	+44	ユーザーSIDへのバイトオフセット。
DataLength	DWORD	4	+48	+48	イベント固有データのバイト長。
DataOffset	DWORD	4	+52	+52	イベント固有データへのバイトオフセット。

各言語での定義

#include <windows.h>

// EVENTLOGRECORD  (x64 56 / x86 56 バイト)
typedef struct EVENTLOGRECORD {
    DWORD Length;
    DWORD Reserved;
    DWORD RecordNumber;
    DWORD TimeGenerated;
    DWORD TimeWritten;
    DWORD EventID;
    REPORT_EVENT_TYPE EventType;
    WORD NumStrings;
    WORD EventCategory;
    WORD ReservedFlags;
    DWORD ClosingRecordNumber;
    DWORD StringOffset;
    DWORD UserSidLength;
    DWORD UserSidOffset;
    DWORD DataLength;
    DWORD DataOffset;
} EVENTLOGRECORD;

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENTLOGRECORD
{
    public uint Length;
    public uint Reserved;
    public uint RecordNumber;
    public uint TimeGenerated;
    public uint TimeWritten;
    public uint EventID;
    public ushort EventType;
    public ushort NumStrings;
    public ushort EventCategory;
    public ushort ReservedFlags;
    public uint ClosingRecordNumber;
    public uint StringOffset;
    public uint UserSidLength;
    public uint UserSidOffset;
    public uint DataLength;
    public uint DataOffset;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENTLOGRECORD
    Public Length As UInteger
    Public Reserved As UInteger
    Public RecordNumber As UInteger
    Public TimeGenerated As UInteger
    Public TimeWritten As UInteger
    Public EventID As UInteger
    Public EventType As UShort
    Public NumStrings As UShort
    Public EventCategory As UShort
    Public ReservedFlags As UShort
    Public ClosingRecordNumber As UInteger
    Public StringOffset As UInteger
    Public UserSidLength As UInteger
    Public UserSidOffset As UInteger
    Public DataLength As UInteger
    Public DataOffset As UInteger
End Structure

import ctypes
from ctypes import wintypes

class EVENTLOGRECORD(ctypes.Structure):
    _fields_ = [
        ("Length", wintypes.DWORD),
        ("Reserved", wintypes.DWORD),
        ("RecordNumber", wintypes.DWORD),
        ("TimeGenerated", wintypes.DWORD),
        ("TimeWritten", wintypes.DWORD),
        ("EventID", wintypes.DWORD),
        ("EventType", ctypes.c_ushort),
        ("NumStrings", ctypes.c_ushort),
        ("EventCategory", ctypes.c_ushort),
        ("ReservedFlags", ctypes.c_ushort),
        ("ClosingRecordNumber", wintypes.DWORD),
        ("StringOffset", wintypes.DWORD),
        ("UserSidLength", wintypes.DWORD),
        ("UserSidOffset", wintypes.DWORD),
        ("DataLength", wintypes.DWORD),
        ("DataOffset", wintypes.DWORD),
    ]

#[repr(C)]
pub struct EVENTLOGRECORD {
    pub Length: u32,
    pub Reserved: u32,
    pub RecordNumber: u32,
    pub TimeGenerated: u32,
    pub TimeWritten: u32,
    pub EventID: u32,
    pub EventType: u16,
    pub NumStrings: u16,
    pub EventCategory: u16,
    pub ReservedFlags: u16,
    pub ClosingRecordNumber: u32,
    pub StringOffset: u32,
    pub UserSidLength: u32,
    pub UserSidOffset: u32,
    pub DataLength: u32,
    pub DataOffset: u32,
}

import "golang.org/x/sys/windows"

type EVENTLOGRECORD struct {
	Length uint32
	Reserved uint32
	RecordNumber uint32
	TimeGenerated uint32
	TimeWritten uint32
	EventID uint32
	EventType uint16
	NumStrings uint16
	EventCategory uint16
	ReservedFlags uint16
	ClosingRecordNumber uint32
	StringOffset uint32
	UserSidLength uint32
	UserSidOffset uint32
	DataLength uint32
	DataOffset uint32
}

type
  EVENTLOGRECORD = record
    Length: DWORD;
    Reserved: DWORD;
    RecordNumber: DWORD;
    TimeGenerated: DWORD;
    TimeWritten: DWORD;
    EventID: DWORD;
    EventType: Word;
    NumStrings: Word;
    EventCategory: Word;
    ReservedFlags: Word;
    ClosingRecordNumber: DWORD;
    StringOffset: DWORD;
    UserSidLength: DWORD;
    UserSidOffset: DWORD;
    DataLength: DWORD;
    DataOffset: DWORD;
  end;

const EVENTLOGRECORD = extern struct {
    Length: u32,
    Reserved: u32,
    RecordNumber: u32,
    TimeGenerated: u32,
    TimeWritten: u32,
    EventID: u32,
    EventType: u16,
    NumStrings: u16,
    EventCategory: u16,
    ReservedFlags: u16,
    ClosingRecordNumber: u32,
    StringOffset: u32,
    UserSidLength: u32,
    UserSidOffset: u32,
    DataLength: u32,
    DataOffset: u32,
};

type
  EVENTLOGRECORD {.bycopy.} = object
    Length: uint32
    Reserved: uint32
    RecordNumber: uint32
    TimeGenerated: uint32
    TimeWritten: uint32
    EventID: uint32
    EventType: uint16
    NumStrings: uint16
    EventCategory: uint16
    ReservedFlags: uint16
    ClosingRecordNumber: uint32
    StringOffset: uint32
    UserSidLength: uint32
    UserSidOffset: uint32
    DataLength: uint32
    DataOffset: uint32

struct EVENTLOGRECORD
{
    uint Length;
    uint Reserved;
    uint RecordNumber;
    uint TimeGenerated;
    uint TimeWritten;
    uint EventID;
    ushort EventType;
    ushort NumStrings;
    ushort EventCategory;
    ushort ReservedFlags;
    uint ClosingRecordNumber;
    uint StringOffset;
    uint UserSidLength;
    uint UserSidOffset;
    uint DataLength;
    uint DataOffset;
}

HSP用定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; EVENTLOGRECORD サイズ: 56 バイト(x64)
dim st, 14    ; 4byte整数×14(構造体サイズ 56 / 4 切り上げ)
; Length : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; Reserved : DWORD (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; RecordNumber : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; TimeGenerated : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; TimeWritten : DWORD (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; EventID : DWORD (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; EventType : REPORT_EVENT_TYPE (+24, 2byte)  wpoke st,24,値  /  値 = wpeek(st,24)
; NumStrings : WORD (+26, 2byte)  wpoke st,26,値  /  値 = wpeek(st,26)
; EventCategory : WORD (+28, 2byte)  wpoke st,28,値  /  値 = wpeek(st,28)
; ReservedFlags : WORD (+30, 2byte)  wpoke st,30,値  /  値 = wpeek(st,30)
; ClosingRecordNumber : DWORD (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; StringOffset : DWORD (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; UserSidLength : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; UserSidOffset : DWORD (+44, 4byte)  st.11 = 値  /  値 = st.11   (lpoke/lpeek も可)
; DataLength : DWORD (+48, 4byte)  st.12 = 値  /  値 = st.12   (lpoke/lpeek も可)
; DataOffset : DWORD (+52, 4byte)  st.13 = 値  /  値 = st.13   (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
#defstruct global EVENTLOGRECORD
    #field int Length
    #field int Reserved
    #field int RecordNumber
    #field int TimeGenerated
    #field int TimeWritten
    #field int EventID
    #field short EventType
    #field short NumStrings
    #field short EventCategory
    #field short ReservedFlags
    #field int ClosingRecordNumber
    #field int StringOffset
    #field int UserSidLength
    #field int UserSidOffset
    #field int DataLength
    #field int DataOffset
#endstruct

stdim st, EVENTLOGRECORD        ; NSTRUCT 変数を確保
st->Length = 100
mes "Length=" + st->Length

EVENTLOGRECORD

フィールド

各言語での定義

HSP用 定義

HSP用定義