// HANDLE hEventLog; // At least for user logs, a handle is kept opened (by eventlog service) as long as the event viewer has the focus on this log.
PWSTRComputerName;// Computer where the log resides
/** Cached information **/
PWSTRLogName;// Internal name (from registry, or file path for user logs)
PWSTRFileName;// Cached, for user logs; retrieved once (at startup) from registry for system logs (i.e. may be different from the one opened by the eventlog service)
// PWSTR DisplayName; // The default value is the one computed; can be modified by the user for this local session only.
// We can use the TreeView' item name for the DisplayName...
BOOLPermanent;// TRUE: system log; FALSE: user log
/** Volatile information **/
// ULONG Flags;
// ULONG MaxSize; // Always retrieved from registry (only valid for system logs)
// ULONG Retention; // Always retrieved from registry (only valid for system logs)
}EVENTLOG,*PEVENTLOG;
typedefstruct_EVENTLOGFILTER
{
LIST_ENTRYListEntry;
LONGReferenceCount;
// HANDLE hEnumEventsThread;
// HANDLE hStopEnumEvent;
// PWSTR DisplayName; // The default value is the one computed; can be modified by the user for this local session only.
// We can use the TreeView' item name for the DisplayName...