How to read boot events in Windows 7?

Question

I'm trying to use ETW functions without success to read the file C: \ Windows \ System32 \ winevt \ Logs \ Microsoft-Windows-Diagnostics-Performance% 4Operational.evtx to capture load time events. I tried various functions -

• OpenTrace gives error 161
• EvtQuery gives error 15000

Does anyone have an example of their own code reading system trace files?

Answer 1

I got this work as follows:

LPWSTR pwsPath = L"Microsoft-Windows-Diagnostics-Performance/Operational";
LPWSTR pwsQuery = L"Event/System[EventID=100]";

hResults = EvtQuery(NULL, pwsPath, pwsQuery,
                    EvtQueryChannelPath | EvtQueryReverseDirection);

The channel name can be found by going to "Properties" in the event log and using its Full name.

15000 , .

Answer 2

, API . , , .