EvtCreateBookmark function (winevt.h)
Creates a bookmark that identifies an event in a channel.
Syntax
EVT_HANDLE EvtCreateBookmark(
[in, optional] LPCWSTR BookmarkXml
);
Parameters
[in, optional] BookmarkXml
An XML string that contains the bookmark or NULL if creating a bookmark.
Return value
A handle to the bookmark if the call succeeds; otherwise, NULL. If NULL, call the GetLastError function to get the error code.
Remarks
To create a bookmark, set the BookmarkXml parameter to NULL. Before you exit, call the EvtUpdateBookmark function to update the bookmark. Pass the bookmark handle to the EvtRender function to render the bookmark as an XML string. You can then persist the string for use later. To begin consuming events from where you left off the last time, set BookmarkXml to the XML string that you persisted. For a subscription, pass the bookmark handle to the EvtSubscribe function. For a query, pass the bookmark handle to the EvtSeek function to seek to a specific event in the query result.
If the query is against multiple channels, the bookmark handle will contain bookmarks for each channel. You cannot create a bookmark for a log file.
You must call the EvtClose function to close the handle when done.
Examples
For an example that shows how to use this function, see Bookmarking Events.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows Vista [desktop apps only] |
| Minimum supported server | Windows Server 2008 [desktop apps only] |
| Target Platform | Windows |
| Header | winevt.h |
| Library | Wevtapi.lib |
| DLL | Wevtapi.dll |