EvtCreateBookmark function

Creates a bookmark that identifies an event in a channel.

Syntax


EVT_HANDLE WINAPI EvtCreateBookmark(
  _In_opt_  LPCWSTR BookmarkXml
);

Parameters

BookmarkXml [in, optional]

An XML string that contains the bookmark or NULL if creating a bookmark.

Return value

A handle to the bookmark if the call succeeds; otherwise, NULL. If NULL, call the GetLastError function to get the error code.

Remarks

To create a bookmark, set the BookmarkXml parameter to NULL. Before you exit, call the EvtUpdateBookmark function to update the bookmark. Pass the bookmark handle to the EvtRender function to render the bookmark as an XML string. You can then persist the string for use later. To begin consuming events from where you left off the last time, set BookmarkXml to the XML string that you persisted. For a subscription, pass the bookmark handle to the EvtSubscribe function. For a query, pass the bookmark handle to the EvtSeek function to seek to a specific event in the query result.

If the query is against multiple channels, the bookmark handle will contain bookmarks for each channel. You cannot create a bookmark for a log file.

You must call the EvtClose function to close the handle when done.

Examples

For an example that shows how to use this function, see Bookmarking Events.

Requirements

Minimum supported client

Windows Vista [desktop apps only]

Minimum supported server

Windows Server 2008 [desktop apps only]

Header

WinEvt.h

Library

Wevtapi.lib

DLL

Wevtapi.dll

See also

EvtUpdateBookmark

 

 

Community Additions

ADD
Show:
© 2014 Microsoft