c++ - EventLog 函数返回 ERROR_INVALID_PARAMETER

Question

在尝试读取和获取事件日志中的事件数时，出现错误 87。

#include <windows.h>
#include <stdio.h>
#include <strsafe.h>
#define PROVIDER_NAME "System"

void wmain(void)
{
    HANDLE hEventLog = NULL;
    DWORD status = ERROR_SUCCESS;
    PDWORD numEvents = 0;

    hEventLog = OpenEventLog(NULL, PROVIDER_NAME);
    printf("Last error: %lu\n", GetLastError());
    if (!GetNumberOfEventLogRecords(hEventLog, numEvents))
    {
        printf("Failed GetNumberOfEventLogRecords: %lu\n", GetLastError());

    }

输出:

Last error: 0
Failed GetNumberOfEventLogRecords: 87

我在 PROVIDER_NAME 上尝试了一些变体，我的示例基于此文档，但是一旦我像我的示例一样进行任何类型的调整，我就会遇到 ERROR_INVALID_PARAMETER

https://learn.microsoft.com/en-us/windows/win32/eventlog/querying-for-event-source-messages

我不确定引用的错误参数是什么。

Answer 1

NumberOfRecords

A pointer to a variable that receives the number of records in the specified event log.

您需要传递一个 DWORD 值的地址，以获取数字

#include <windows.h>
#include <stdio.h>
#include <strsafe.h>
#define PROVIDER_NAME "System"

int wmain(void)
{
    HANDLE hEventLog = NULL;
    DWORD status = ERROR_SUCCESS;
    DWORD numEvents = 0;

    hEventLog = OpenEventLog(NULL, PROVIDER_NAME);
    printf("Last error: %lu\n", GetLastError());
    if (!GetNumberOfEventLogRecords(hEventLog, &numEvents))
    {
        printf("Failed GetNumberOfEventLogRecords: %lu\n", GetLastError());

    }
}