EVT_SUBSCRIBE_CALLBACK callback function (winevt.h)

Implement this callback if you call the EvtSubscribe function to receive events that match your query. The service calls your callback when events that match your query criteria are raised.

Syntax

EVT_SUBSCRIBE_CALLBACK EvtSubscribeCallback;

DWORD EvtSubscribeCallback(
  EVT_SUBSCRIBE_NOTIFY_ACTION Action,
  PVOID UserContext,
  EVT_HANDLE Event
)
{...}

Parameters

Action

Determines whether the Event parameter contains an event or an error code. For possible notify action values, see the EVT_SUBSCRIBE_NOTIFY_ACTION enumeration.

UserContext

The context that the subscriber passed to the EvtSubscribe function.

Event

A handle to the event. The event handle is only valid for the duration of the callback function. You can use this handle with any event log function that takes an event handle (for example, EvtRender or EvtFormatMessage).

Do not call EvtClose to close this handle; the service will close the handle when the callback returns.

If the Action parameter is EvtSubscribeActionError, cast Event to a DWORD to access the Win32 error code.

Return value

The service ignores the return code that you return.

Remarks

This callback will block other events from being delivered to your callback, so keep your implementation as short as possible.

If the service encounters an error while setting up the subscription, your callback will not receive any notification that an error occurred.

If the Flags parameter of EvtSubscribe includes EvtSubscribeStrict, your callback will receive notification when event records are missing. In this case, the value of Event will be ERROR_EVT_QUERY_RESULT_STALE.

To cancel the subscription, you must close the subscription handle that the EvtSubscribe function returns.

Examples

For an example that implements EVT_SUBSCRIBE_CALLBACK callback function, see Subscribing to Events.

Requirements

See also

EvtSubscribe