GetNumberOfEventLogRecords returns incorrect number of event logs

Question

I have this C++ code to read the event log records

DWORD GetLogRecords(LPCWSTR wsLogFile)
{
  HANDLE hEvt = OpenEventLog(NULL, wsLogFile);
  if (hEvt==NULL)          


        

Answer 1

You are not checking the result of GetNumberOfEventLogRecords() for an error. And you are leaking the log handle. Try this instead:

DWORD GetLogRecords(LPCWSTR wsLogFile)
{
  HANDLE hEvt = OpenEventLog(NULL, wsLogFile);
  if (hEvt==NULL) return 0;

  DWORD dwTotalRecords;
  BOOL res = GetNumberOfEventLogRecords(hEvt, &dwTotalRecords);
  CloseEventLog(hEvt);

  return (res != 0) ? dwTotalRecords : 0;
}