ホーム › System.EventLog › EVENTSFORLOGFILE

EVENTSFORLOGFILE

構造体

サイズx64: 576 バイト / x86: 576 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド	型	サイズ	x64	x86	説明
ulSize	DWORD	4	+0	+0	本構造体全体のバイトサイズ。
szLogicalLogFile	WCHAR	512	+4	+4	論理ログファイル名(ワイド文字列)。
ulNumRecords	DWORD	4	+516	+516	含まれるイベントレコード数。
pEventLogRecords	EVENTLOGRECORD	56	+520	+520	EVENTLOGRECORD配列の先頭。可変長。

各言語での定義

#include <windows.h>

// EVENTLOGRECORD  (x64 56 / x86 56 バイト)
typedef struct EVENTLOGRECORD {
    DWORD Length;
    DWORD Reserved;
    DWORD RecordNumber;
    DWORD TimeGenerated;
    DWORD TimeWritten;
    DWORD EventID;
    REPORT_EVENT_TYPE EventType;
    WORD NumStrings;
    WORD EventCategory;
    WORD ReservedFlags;
    DWORD ClosingRecordNumber;
    DWORD StringOffset;
    DWORD UserSidLength;
    DWORD UserSidOffset;
    DWORD DataLength;
    DWORD DataOffset;
} EVENTLOGRECORD;

// EVENTSFORLOGFILE  (x64 576 / x86 576 バイト)
typedef struct EVENTSFORLOGFILE {
    DWORD ulSize;
    WCHAR szLogicalLogFile[256];
    DWORD ulNumRecords;
    EVENTLOGRECORD pEventLogRecords[1];
} EVENTSFORLOGFILE;

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENTLOGRECORD
{
    public uint Length;
    public uint Reserved;
    public uint RecordNumber;
    public uint TimeGenerated;
    public uint TimeWritten;
    public uint EventID;
    public ushort EventType;
    public ushort NumStrings;
    public ushort EventCategory;
    public ushort ReservedFlags;
    public uint ClosingRecordNumber;
    public uint StringOffset;
    public uint UserSidLength;
    public uint UserSidOffset;
    public uint DataLength;
    public uint DataOffset;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EVENTSFORLOGFILE
{
    public uint ulSize;
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] public string szLogicalLogFile;
    public uint ulNumRecords;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public EVENTLOGRECORD[] pEventLogRecords;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENTLOGRECORD
    Public Length As UInteger
    Public Reserved As UInteger
    Public RecordNumber As UInteger
    Public TimeGenerated As UInteger
    Public TimeWritten As UInteger
    Public EventID As UInteger
    Public EventType As UShort
    Public NumStrings As UShort
    Public EventCategory As UShort
    Public ReservedFlags As UShort
    Public ClosingRecordNumber As UInteger
    Public StringOffset As UInteger
    Public UserSidLength As UInteger
    Public UserSidOffset As UInteger
    Public DataLength As UInteger
    Public DataOffset As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EVENTSFORLOGFILE
    Public ulSize As UInteger
    <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=256)> Public szLogicalLogFile As String
    Public ulNumRecords As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)> Public pEventLogRecords() As EVENTLOGRECORD
End Structure

import ctypes
from ctypes import wintypes

class EVENTLOGRECORD(ctypes.Structure):
    _fields_ = [
        ("Length", wintypes.DWORD),
        ("Reserved", wintypes.DWORD),
        ("RecordNumber", wintypes.DWORD),
        ("TimeGenerated", wintypes.DWORD),
        ("TimeWritten", wintypes.DWORD),
        ("EventID", wintypes.DWORD),
        ("EventType", ctypes.c_ushort),
        ("NumStrings", ctypes.c_ushort),
        ("EventCategory", ctypes.c_ushort),
        ("ReservedFlags", ctypes.c_ushort),
        ("ClosingRecordNumber", wintypes.DWORD),
        ("StringOffset", wintypes.DWORD),
        ("UserSidLength", wintypes.DWORD),
        ("UserSidOffset", wintypes.DWORD),
        ("DataLength", wintypes.DWORD),
        ("DataOffset", wintypes.DWORD),
    ]

class EVENTSFORLOGFILE(ctypes.Structure):
    _fields_ = [
        ("ulSize", wintypes.DWORD),
        ("szLogicalLogFile", ctypes.c_wchar * 256),
        ("ulNumRecords", wintypes.DWORD),
        ("pEventLogRecords", EVENTLOGRECORD * 1),
    ]

#[repr(C)]
pub struct EVENTLOGRECORD {
    pub Length: u32,
    pub Reserved: u32,
    pub RecordNumber: u32,
    pub TimeGenerated: u32,
    pub TimeWritten: u32,
    pub EventID: u32,
    pub EventType: u16,
    pub NumStrings: u16,
    pub EventCategory: u16,
    pub ReservedFlags: u16,
    pub ClosingRecordNumber: u32,
    pub StringOffset: u32,
    pub UserSidLength: u32,
    pub UserSidOffset: u32,
    pub DataLength: u32,
    pub DataOffset: u32,
}

#[repr(C)]
pub struct EVENTSFORLOGFILE {
    pub ulSize: u32,
    pub szLogicalLogFile: [u16; 256],
    pub ulNumRecords: u32,
    pub pEventLogRecords: [EVENTLOGRECORD; 1],
}

import "golang.org/x/sys/windows"

type EVENTLOGRECORD struct {
	Length uint32
	Reserved uint32
	RecordNumber uint32
	TimeGenerated uint32
	TimeWritten uint32
	EventID uint32
	EventType uint16
	NumStrings uint16
	EventCategory uint16
	ReservedFlags uint16
	ClosingRecordNumber uint32
	StringOffset uint32
	UserSidLength uint32
	UserSidOffset uint32
	DataLength uint32
	DataOffset uint32
}

type EVENTSFORLOGFILE struct {
	ulSize uint32
	szLogicalLogFile [256]uint16
	ulNumRecords uint32
	pEventLogRecords [1]EVENTLOGRECORD
}

type
  EVENTLOGRECORD = record
    Length: DWORD;
    Reserved: DWORD;
    RecordNumber: DWORD;
    TimeGenerated: DWORD;
    TimeWritten: DWORD;
    EventID: DWORD;
    EventType: Word;
    NumStrings: Word;
    EventCategory: Word;
    ReservedFlags: Word;
    ClosingRecordNumber: DWORD;
    StringOffset: DWORD;
    UserSidLength: DWORD;
    UserSidOffset: DWORD;
    DataLength: DWORD;
    DataOffset: DWORD;
  end;

  EVENTSFORLOGFILE = record
    ulSize: DWORD;
    szLogicalLogFile: array[0..255] of WideChar;
    ulNumRecords: DWORD;
    pEventLogRecords: array[0..0] of EVENTLOGRECORD;
  end;

const EVENTLOGRECORD = extern struct {
    Length: u32,
    Reserved: u32,
    RecordNumber: u32,
    TimeGenerated: u32,
    TimeWritten: u32,
    EventID: u32,
    EventType: u16,
    NumStrings: u16,
    EventCategory: u16,
    ReservedFlags: u16,
    ClosingRecordNumber: u32,
    StringOffset: u32,
    UserSidLength: u32,
    UserSidOffset: u32,
    DataLength: u32,
    DataOffset: u32,
};

const EVENTSFORLOGFILE = extern struct {
    ulSize: u32,
    szLogicalLogFile: [256]u16,
    ulNumRecords: u32,
    pEventLogRecords: [1]EVENTLOGRECORD,
};

type
  EVENTLOGRECORD {.bycopy.} = object
    Length: uint32
    Reserved: uint32
    RecordNumber: uint32
    TimeGenerated: uint32
    TimeWritten: uint32
    EventID: uint32
    EventType: uint16
    NumStrings: uint16
    EventCategory: uint16
    ReservedFlags: uint16
    ClosingRecordNumber: uint32
    StringOffset: uint32
    UserSidLength: uint32
    UserSidOffset: uint32
    DataLength: uint32
    DataOffset: uint32

  EVENTSFORLOGFILE {.bycopy.} = object
    ulSize: uint32
    szLogicalLogFile: array[256, uint16]
    ulNumRecords: uint32
    pEventLogRecords: array[1, EVENTLOGRECORD]

struct EVENTLOGRECORD
{
    uint Length;
    uint Reserved;
    uint RecordNumber;
    uint TimeGenerated;
    uint TimeWritten;
    uint EventID;
    ushort EventType;
    ushort NumStrings;
    ushort EventCategory;
    ushort ReservedFlags;
    uint ClosingRecordNumber;
    uint StringOffset;
    uint UserSidLength;
    uint UserSidOffset;
    uint DataLength;
    uint DataOffset;
}

struct EVENTSFORLOGFILE
{
    uint ulSize;
    wchar[256] szLogicalLogFile;
    uint ulNumRecords;
    EVENTLOGRECORD[1] pEventLogRecords;
}

HSP用定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; EVENTSFORLOGFILE サイズ: 576 バイト(x64)
dim st, 144    ; 4byte整数×144(構造体サイズ 576 / 4 切り上げ)
; ulSize : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; szLogicalLogFile : WCHAR (+4, 512byte)  varptr(st)+4 を基点に操作(512byte:入れ子/配列)
; ulNumRecords : DWORD (+516, 4byte)  st.129 = 値  /  値 = st.129   (lpoke/lpeek も可)
; pEventLogRecords : EVENTLOGRECORD (+520, 56byte)  varptr(st)+520 を基点に操作(56byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global EVENTLOGRECORD
    #field int Length
    #field int Reserved
    #field int RecordNumber
    #field int TimeGenerated
    #field int TimeWritten
    #field int EventID
    #field short EventType
    #field short NumStrings
    #field short EventCategory
    #field short ReservedFlags
    #field int ClosingRecordNumber
    #field int StringOffset
    #field int UserSidLength
    #field int UserSidOffset
    #field int DataLength
    #field int DataOffset
#endstruct

#defstruct global EVENTSFORLOGFILE
    #field int ulSize
    #field wchar szLogicalLogFile 256
    #field int ulNumRecords
    #field EVENTLOGRECORD pEventLogRecords 1
#endstruct

stdim st, EVENTSFORLOGFILE        ; NSTRUCT 変数を確保
st->ulSize = 100
mes "ulSize=" + st->ulSize

EVENTSFORLOGFILE

フィールド

各言語での定義

HSP用 定義

HSP用定義