Contains information that is included immediately after the newest event log record.

The ELF_EOF_RECORD structure is used in an event log to enable the event-logging service to recontruct the ELF_LOGFILE_HEADER. The event-logging service must add the ELF_EOF_RECORD to the event log. For more information about ELF_EOF_RECORD, see Event Log File Format.

Syntax

typedef struct _EVENTLOGEOF {
  ULONG RecordSizeBeginning;
  ULONG One;
  ULONG Two;
  ULONG Three;
  ULONG Four;
  ULONG BeginRecord;
  ULONG EndRecord;
  ULONG CurrentRecordNumber;
  ULONG OldestRecordNumber;
  ULONG RecordSizeEnd;
}EVENTLOGEOF, *PEVENTLOGEOF;

Members

RecordSizeBeginning

The beginning size of the ELF_EOF_RECORD. The beginning size is always 0x28.

One

An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x11111111.

Two

An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x22222222.

Three

An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x33333333.

Four

An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x44444444.

BeginRecord

The offset to the oldest record. If the event log is empty, this is set to the start of this structure.

EndRecord

The offset to the start of this structure.

CurrentRecordNumber

The record number of the next event that will be written to the event log.

OldestRecordNumber

The record number of the oldest record in the event log. The record number will be 0 if the event log is empty.

RecordSizeEnd

The ending size of the ELF_EOF_RECORD. The ending size is always 0x28.

Remarks

If the event log is empty, the ELF_EOF_RECORD is written immediately after the ELF_LOGFILE_HEADER.

Requirements

See Also

ELF_LOGFILE_HEADER

EVENTLOGRECORD

Event Log File Format

Send comments about this topic to Microsoft

Build date: 11/12/2009