Search code examples
winapievent-log

How to open windows' service-specific event log


We need to read service-specific event log "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" programmatically. Following code

LPWSTR pwsLogName = L"Microsoft-Windows-TerminalServices-LocalSessionManager/Operational";
HANDLE hEventLog = OpenEventLog(nullptr, pwsLogName);

results opening "Application" log instead of required.

In the same time command line utility wevtutil can succesfuly read needed log:

wevtutil query-events Microsoft-Windows-TerminalServices-LocalSessionManager/Operational

What are we doing wrong?


Solution

  • Finally we've found OpenEventLog() is dead and we need to use Evt* functions (EvtQuery & company)