GetNumberOfEventLogRecords returns incorrect number of event logs

Question

I have this C++ code to read the event log records

DWORD GetLogRecords(LPCWSTR wsLogFile)
{
  HANDLE hEvt = OpenEventLog(NULL, wsLogFile);
  if (hEvt==NULL)          


        

Answer 1

For the benefit of others, the solution to this problem is that OpenEventLog doesn't accept a pathname. Instead you have to give it the source name of the event log (something like "HardwareEvents").

If you call OpenEventLog with an invalid source name (which includes providing a pathname), then as documented it will open the Application log instead:

If you specify a custom log and it cannot be found, the event logging service opens the Application log.