EvtCreateBookmark function (winevt.h)

Creates a bookmark that identifies an event in a channel.

Syntax

EVT_HANDLE EvtCreateBookmark(
  [in, optional] LPCWSTR BookmarkXml
);

Parameters

[in, optional] BookmarkXml

An XML string that contains the bookmark or NULL if creating a bookmark.

Return value

A handle to the bookmark if the call succeeds; otherwise, NULL. If NULL, call the GetLastError function to get the error code.

Remarks

To create a bookmark, set the BookmarkXml parameter to NULL. Before you exit, call the EvtUpdateBookmark function to update the bookmark. Pass the bookmark handle to the EvtRender function to render the bookmark as an XML string. You can then persist the string for use later. To begin consuming events from where you left off the last time, set BookmarkXml to the XML string that you persisted. For a subscription, pass the bookmark handle to the EvtSubscribe function. For a query, pass the bookmark handle to the EvtSeek function to seek to a specific event in the query result.

If the query is against multiple channels, the bookmark handle will contain bookmarks for each channel. You cannot create a bookmark for a log file.

You must call the EvtClose function to close the handle when done.

Examples

For an example that shows how to use this function, see Bookmarking Events.

Requirements

See also

EvtUpdateBookmark