Search code examples
event-log

How do I read the setup eventlog on windows 7

I have some C++ code which reads the Application, Security or System eventlogs quite happily using OpenEventLog and ReadEventLog API calls. I want to read the Setup eventlog on Windows 7 so I pass "Setup" as the log name into OpenEventLog but I just get back the contents of the Application log (which is the documented behaviour for unknown logs). How do I read the Setup eventlog?

Solution

  • I have solved this. Because the setup eventlog is a new format log it can only be opened using the new API calls EvtQuery, EvtNext etc., the old OpenEventLog/ReadEventLog functions do not work on it.