From: Joseph M. Newcomer on
YOu have not actually said what you expected and what you got. THis is very important.

Generally, the "text" of an event log record is obtained from the MessageTable associated
with the application that registered the message. All that is stored in the even log is
the "variable text" for the message, usually a word or two. ReadEventLog fills in an
EventLogRecord which contains the event source and the event ID. You will have to use the
registered event source to locate the EXE or DLL that holds the MessageTable, and
LoadLibrary and FormatMessage to get the rest of the text. If you are not doing this,
then you should not expect to see the "text" of the message. That's what the Event Viewer
does to display the information.

On Fri, 19 Mar 2010 06:59:28 -0700 (PDT), MyGroup <paulganesh(a)> wrote:

>Hi All,
>I have an MFC application that reads and displays event log records
>using the ::ReadEventLog() API. The problem is with reading the
>"Description" message string of the event log record. The MFC
>application is unable to read the complete "Description" message
>string and displays only some part of it. However the Windows System
>Event Log Viewer reads and displays the complete "Description" message
>string correctly.
>I have ensured that my MFC application reads the entire "Description"
>message string by retrieving all the strings as provided by the
>"NumStrings" and "StringOffset" member variables of the EVENTLOGRECORD
>structure and merging all of them. Also as mentioned in MSDN my
>application loads the Source Name specific message library file (whose
>path is specified in the registry at HKEY_LOCAL_MACHINE\SYSTEM
>\CurrentControlSet\Services\EventLog\Application\[SourceName]) that
>further contains additional message string information and merges it
>with the earlier read strings.
>I am still unable to get the entire "Description" message string.
>Please provide any help towards resolving the issue.
>Ganesh Paul
Joseph M. Newcomer [MVP]
email: newcomer(a)
MVP Tips: