无法检索事件日志记录的完整描述字符串
我有一个 MFC 应用程序，它使用 ::ReadEventLog() API 读取和显示事件日志记录。问题在于读取事件日志记录的“描述”消息字符串。 MFC 应用程序无法读取完整的“描述”消息字符串，仅显示其中的一部分。但是，Windows 系统事件日志查看器可以正确读取并显示完整的“描述”消息字符串。
我确保我的 MFC 应用程序通过检索 EVENTLOGRECORD 结构的“NumStrings”和“StringOffset”成员变量提供的所有字符串并合并所有字符串来读取整个“Description”消息字符串。另外，正如 MSDN 中提到的，我的应用程序加载源名称特定的消息库文件（其路径在注册表中的 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application[SourceName] 中指定），该文件进一步包含其他消息字符串信息并将其与较早读取的字符串。
我仍然无法获取整个“描述”消息字符串。
请提供解决问题的任何帮助。
问候，
桑托什。
I have an MFC application that reads and displays event log records using the ::ReadEventLog() API. The problem is with reading the "Description" message string of the event log record. The MFC application is unable to read the complete "Description" message string and displays only some part of it. However the Windows System Event Log Viewer reads and displays the complete "Description" message string correctly.
I have ensured that my MFC application reads the entire "Description" message string by retrieving all the strings as provided by the "NumStrings" and "StringOffset" member variables of the EVENTLOGRECORD structure and merging all of them. Also as mentioned in MSDN my application loads the Source Name specific message library file (whose path is specified in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application[SourceName]) that further contains additional message string information and merges it with the earlier read strings.
I am still unable to get the entire "Description" message string.
Please provide any help towards resolving the issue.
Regards,
Santosh.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这对于事件中的所有描述消息是否一致，或者您是否只监视之前从自己的应用程序创建的某些事件条目？
也许描述中嵌入了 NUL 字符，导致您的 MFC 代码在显示字符串时过早终止该字符串，即使正确检索了原始字符串也是如此？
Is this consistent for all description messages in events, or are you only monitoring certain event entries that you have previously created from your own application?
Perhaps there are embedded NUL characters in the description that are causing your MFC code to prematurely terminate the string when it is being displayed, even if the original string was retrieved correctly?