Hi,
I've written code to view the contents of an Event file (.EVT) in
Windows' Event Viewer.
I've created a new Registry entry:
SYSTEM\\CurrentControlSet\\Services\\EventLog\\My_Events.
The "File" subkey of this entry has the value:
%SystemRoot%\system32\config\MyEvent.Evt
(This file name is a #define in the code. So if I want to open
"AnotherEventFile.Evt", I set the #define to this file.)
Now the PROBLEM:
Right after executing my code, I DO NOT see the contents of the EVT
file in Event Viewer. The Registry entry has the correct EVT file
specified, Event Viewer correctly shows a section called "My_Events"
below the "Application", "System" and "Security" sections, and when I
view the properties of "My_Events", the correct EVT file specified is
seen.
ONLY WHEN I RESTART MY SYSTEM DO I SEE THE CONTENTS OF THE FILE.
Why can I not see the EVT file contents right after my code executes??
Is this a refresh problem, in which case some API is to be used to
notify Windows that a Registry value has been updated?
Will be grateful if someone could help me out with this!
Thanks in advance,
Shankar
|