ELF_EOF_RECORD structure
Contains information that is included immediately after the newest event log record.
The ELF_EOF_RECORD structure is used in an event log to enable the event-logging service to recontruct the ELF_LOGFILE_HEADER. The event-logging service must add the ELF_EOF_RECORD to the event log. For more information about ELF_EOF_RECORD, see Event Log File Format.
Syntax
typedef struct _EVENTLOGEOF {
ULONG RecordSizeBeginning;
ULONG One;
ULONG Two;
ULONG Three;
ULONG Four;
ULONG BeginRecord;
ULONG EndRecord;
ULONG CurrentRecordNumber;
ULONG OldestRecordNumber;
ULONG RecordSizeEnd;
} EVENTLOGEOF, *PEVENTLOGEOF;
Members
RecordSizeBeginning
The beginning size of the ELF_EOF_RECORD. The beginning size is always 0x28.One
An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x11111111.Two
An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x22222222.Three
An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x33333333.Four
An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x44444444.BeginRecord
The offset to the oldest record. If the event log is empty, this is set to the start of this structure.EndRecord
The offset to the start of this structure.CurrentRecordNumber
The record number of the next event that will be written to the event log.OldestRecordNumber
The record number of the oldest record in the event log. The record number will be 0 if the event log is empty.RecordSizeEnd
The ending size of the ELF_EOF_RECORD. The ending size is always 0x28.
Remarks
If the event log is empty, the ELF_EOF_RECORD is written immediately after the ELF_LOGFILE_HEADER.
Requirements
Minimum supported client |
Windows 2000 Professional [desktop apps only] |
Minimum supported server |
Windows 2000 Server [desktop apps only] |
Header |
Winnt.h (include Windows.h) |