65internal static partial bool EvtSeek(global::System.Diagnostics.Eventing.Reader.EventLogHandle resultSet, long position, global::System.Diagnostics.Eventing.Reader.EventLogHandle bookmark, int timeout, global::Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags flags) 103static extern unsafe int __PInvoke(nint __resultSet_native, long __position_native, nint __bookmark_native, int __timeout_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags __flags_native); 292internal static partial bool EvtGetEventInfo(global::System.Diagnostics.Eventing.Reader.EventLogHandle eventHandle, global::Microsoft.Win32.UnsafeNativeMethods.EvtEventPropertyId propertyId, int bufferSize, nint bufferPtr, out int bufferUsed) 328static extern unsafe int __PInvoke(nint __eventHandle_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtEventPropertyId __propertyId_native, int __bufferSize_native, nint __bufferPtr_native, int* __bufferUsed_native); 338internal static partial bool EvtGetQueryInfo(global::System.Diagnostics.Eventing.Reader.EventLogHandle queryHandle, global::Microsoft.Win32.UnsafeNativeMethods.EvtQueryPropertyId propertyId, int bufferSize, nint buffer, ref int bufferRequired) 373static extern unsafe int __PInvoke(nint __queryHandle_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtQueryPropertyId __propertyId_native, int __bufferSize_native, nint __buffer_native, int* __bufferRequired_native); 440internal static partial bool EvtGetPublisherMetadataProperty(global::System.Diagnostics.Eventing.Reader.EventLogHandle publisherMetadataHandle, global::Microsoft.Win32.UnsafeNativeMethods.EvtPublisherMetadataPropertyId propertyId, int flags, int publisherMetadataPropertyBufferSize, nint publisherMetadataPropertyBuffer, out int publisherMetadataPropertyBufferUsed) 476static extern unsafe int __PInvoke(nint __publisherMetadataHandle_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtPublisherMetadataPropertyId __propertyId_native, int __flags_native, int __publisherMetadataPropertyBufferSize_native, nint __publisherMetadataPropertyBuffer_native, int* __publisherMetadataPropertyBufferUsed_native); 686internal static partial bool EvtGetEventMetadataProperty(global::System.Diagnostics.Eventing.Reader.EventLogHandle eventMetadata, global::Microsoft.Win32.UnsafeNativeMethods.EvtEventMetadataPropertyId propertyId, int flags, int eventMetadataPropertyBufferSize, nint eventMetadataPropertyBuffer, out int eventMetadataPropertyBufferUsed) 722static extern unsafe int __PInvoke(nint __eventMetadata_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtEventMetadataPropertyId __propertyId_native, int __flags_native, int __eventMetadataPropertyBufferSize_native, nint __eventMetadataPropertyBuffer_native, int* __eventMetadataPropertyBufferUsed_native); 1033internal static partial bool EvtSetChannelConfigProperty(global::System.Diagnostics.Eventing.Reader.EventLogHandle channelConfig, global::Microsoft.Win32.UnsafeNativeMethods.EvtChannelConfigPropertyId propertyId, int flags, ref global::Microsoft.Win32.UnsafeNativeMethods.EvtVariant propertyValue) 1046fixed (global::Microsoft.Win32.UnsafeNativeMethods.EvtVariant* __propertyValue_native = &propertyValue) 1068static extern unsafe int __PInvoke(nint __channelConfig_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtChannelConfigPropertyId __propertyId_native, int __flags_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtVariant* __propertyValue_native); 1078internal static partial bool EvtGetChannelConfigProperty(global::System.Diagnostics.Eventing.Reader.EventLogHandle channelConfig, global::Microsoft.Win32.UnsafeNativeMethods.EvtChannelConfigPropertyId propertyId, int flags, int propertyValueBufferSize, nint propertyValueBuffer, out int propertyValueBufferUsed) 1114static extern unsafe int __PInvoke(nint __channelConfig_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtChannelConfigPropertyId __propertyId_native, int __flags_native, int __propertyValueBufferSize_native, nint __propertyValueBuffer_native, int* __propertyValueBufferUsed_native); 1180internal static partial bool EvtGetLogInfo(global::System.Diagnostics.Eventing.Reader.EventLogHandle log, global::Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId propertyId, int propertyValueBufferSize, nint propertyValueBuffer, out int propertyValueBufferUsed) 1216static extern unsafe int __PInvoke(nint __log_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId __propertyId_native, int __propertyValueBufferSize_native, nint __propertyValueBuffer_native, int* __propertyValueBufferUsed_native); 1364internal static partial global::System.Diagnostics.Eventing.Reader.EventLogHandle EvtCreateRenderContext(int valuePathsCount, string[] valuePaths, global::Microsoft.Win32.UnsafeNativeMethods.EvtRenderContextFlags flags) 1432static extern unsafe nint __PInvoke(int __valuePathsCount_native, global::System.IntPtr* __valuePaths_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtRenderContextFlags __flags_native); 1442internal static partial bool EvtRender(global::System.Diagnostics.Eventing.Reader.EventLogHandle context, global::System.Diagnostics.Eventing.Reader.EventLogHandle eventHandle, global::Microsoft.Win32.UnsafeNativeMethods.EvtRenderFlags flags, int buffSize, char[] buffer, out int buffUsed, out int propCount) 1486static extern unsafe int __PInvoke(nint __context_native, nint __eventHandle_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtRenderFlags __flags_native, int __buffSize_native, char* __buffer_native, int* __buffUsed_native, int* __propCount_native); 1496internal static partial bool EvtRender(global::System.Diagnostics.Eventing.Reader.EventLogHandle context, global::System.Diagnostics.Eventing.Reader.EventLogHandle eventHandle, global::Microsoft.Win32.UnsafeNativeMethods.EvtRenderFlags flags, int buffSize, nint buffer, out int buffUsed, out int propCount) 1539static extern unsafe int __PInvoke(nint __context_native, nint __eventHandle_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtRenderFlags __flags_native, int __buffSize_native, nint __buffer_native, int* __buffUsed_native, int* __propCount_native); 1549internal static partial bool EvtFormatMessage(global::System.Diagnostics.Eventing.Reader.EventLogHandle publisherMetadataHandle, global::System.Diagnostics.Eventing.Reader.EventLogHandle eventHandle, uint messageId, int valueCount, global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant[] values, global::Microsoft.Win32.UnsafeNativeMethods.EvtFormatMessageFlags flags, int bufferSize, global::System.Span<char> buffer, out int bufferUsed) 1556global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.Native* __values_native = default; 1560scoped global::System.Runtime.InteropServices.Marshalling.ArrayMarshaller<global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant, global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.Native>.ManagedToUnmanagedIn __values_native__marshaller = new(); 1567__values_native__marshaller.FromManaged(values, stackalloc global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.Native[global::System.Runtime.InteropServices.Marshalling.ArrayMarshaller<global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant, global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.Native>.ManagedToUnmanagedIn.BufferSize]); 1569global::System.ReadOnlySpan<global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant> __values_native__managedSpan = __values_native__marshaller.GetManagedValuesSource(); 1570global::System.Span<global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.Native> __values_native__nativeSpan = __values_native__marshaller.GetUnmanagedValuesDestination(); 1573__values_native__nativeSpan[__i0] = global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.ConvertToUnmanaged(__values_native__managedSpan[__i0]); 1607global::System.ReadOnlySpan<global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.Native> __values_native__nativeSpan = __values_native__marshaller.GetUnmanagedValuesDestination(); 1610global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.Free(__values_native__nativeSpan[__i0]); 1623static extern unsafe int __PInvoke(nint __publisherMetadataHandle_native, nint __eventHandle_native, uint __messageId_native, int __valueCount_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtStringVariant.Marshaller.Native* __values_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtFormatMessageFlags __flags_native, int __bufferSize_native, char* __buffer_native, int* __bufferUsed_native); 1633internal static partial bool EvtFormatMessageBuffer(global::System.Diagnostics.Eventing.Reader.EventLogHandle publisherMetadataHandle, global::System.Diagnostics.Eventing.Reader.EventLogHandle eventHandle, uint messageId, int valueCount, nint values, global::Microsoft.Win32.UnsafeNativeMethods.EvtFormatMessageFlags flags, int bufferSize, nint buffer, out int bufferUsed) 1674static extern unsafe int __PInvoke(nint __publisherMetadataHandle_native, nint __eventHandle_native, uint __messageId_native, int __valueCount_native, nint __values_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtFormatMessageFlags __flags_native, int __bufferSize_native, nint __buffer_native, int* __bufferUsed_native); 1684internal static partial global::System.Diagnostics.Eventing.Reader.EventLogHandle EvtOpenSession(global::Microsoft.Win32.UnsafeNativeMethods.EvtLoginClass loginClass, ref global::Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin login, int timeout, int flags) 1688global::Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin.Marshaller.ValueMarshaller.Native __login_native = default; 1693global::Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin.Marshaller.ValueMarshaller __login_native__marshaller = new(); 1730static extern unsafe nint __PInvoke(global::Microsoft.Win32.UnsafeNativeMethods.EvtLoginClass __loginClass_native, global::Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin.Marshaller.ValueMarshaller.Native* __login_native, int __timeout_native, int __flags_native);

68return (EventLogType)((uint)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigType)!); 76return (EventLogIsolation)((uint)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigIsolation)!); 84return (bool)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigEnabled)!; 88NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigEnabled, (object)value); 96return (bool)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigClassicEventlog)!; 104var descriptor = NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigAccess); 110NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigAccess, (object?)value); 118var logFilePath = NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigLogFilePath); 124NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigLogFilePath, (object?)value); 132return (long)((ulong)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigMaxSize)!); 136NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigMaxSize, (object)value); 144object? nativeRetentionObject = NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigRetention); 145object? nativeAutoBackupObject = NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigAutoBackup); 163NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigAutoBackup, (object)false); 164NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigRetention, (object)false); 167NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigAutoBackup, (object)true); 168NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigRetention, (object)true); 171NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigAutoBackup, (object)false); 172NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigRetention, (object)true); 182var owningProviderName = NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigOwningPublisher); 192var providerNames = NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublisherList); 202return (int?)((uint?)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigLevel)); 206NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigLevel, (object?)value); 214return (long?)((ulong?)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigKeywords)); 218NativeWrapper.EvtSetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigKeywords, (object?)value); 226return (int?)((uint?)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigBufferSize)); 234return (int?)((uint?)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigMinBuffers)); 242return (int?)((uint?)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigMaxBuffers)); 250return (int?)((uint?)NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigLatency)); 258return (Guid?)(NativeWrapper.EvtGetChannelConfigProperty(_handle, UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigControlGuid));

20CreationTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogCreationTime); 21LastAccessTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastAccessTime); 22LastWriteTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastWriteTime); 23FileSize = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogFileSize)); 24Attributes = (int?)((uint?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogAttributes)); 25RecordCount = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogNumberOfLogRecords)); 26OldestRecordNumber = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogOldestRecordNumber)); 27IsLogFull = (bool?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogFull);

34Handle = NativeWrapper.EvtCreateRenderContext(paths.Length, paths, UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextValues);

88flag |= (int)UnsafeNativeMethods.EvtQueryFlags.EvtQueryChannelPath; 90flag |= (int)UnsafeNativeMethods.EvtQueryFlags.EvtQueryFilePath; 93flag |= (int)UnsafeNativeMethods.EvtQueryFlags.EvtQueryReverseDirection; 96flag |= (int)UnsafeNativeMethods.EvtQueryFlags.EvtQueryTolerateQueryErrors; 108NativeWrapper.EvtSeek(_handle, 1, bookmarkHandle, 0, UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToBookmark); 225NativeWrapper.EvtSeek(_handle, offset, EventLogHandle.Zero, 0, UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToCurrent); 240NativeWrapper.EvtSeek(_handle, offset, bookmarkHandle, 0, UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToBookmark); 251NativeWrapper.EvtSeek(_handle, offset, EventLogHandle.Zero, 0, UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToFirst); 257NativeWrapper.EvtSeek(_handle, offset, EventLogHandle.Zero, 0, UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToLast); 309string?[] channelNames = (string?[])NativeWrapper.EvtGetQueryInfo(queryHandle, UnsafeNativeMethods.EvtQueryPropertyId.EvtQueryNames)!; 310int[] errorStatuses = (int[])NativeWrapper.EvtGetQueryInfo(queryHandle, UnsafeNativeMethods.EvtQueryPropertyId.EvtQueryStatuses)!;

60NativeWrapper.EvtRenderBufferWithContextSystem(_session.renderContextHandleSystem, Handle, UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues, _systemProperties); 238return _containerChannel ??= (string?)NativeWrapper.EvtGetEventInfo(this.Handle, UnsafeNativeMethods.EvtEventPropertyId.EvtEventPath); 251return _matchedQueryIds ??= (int[]?)NativeWrapper.EvtGetEventInfo(this.Handle, UnsafeNativeMethods.EvtEventPropertyId.EvtEventQueryIDs);

66this.renderContextHandleSystem = NativeWrapper.EvtCreateRenderContext(0, null, UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextSystem); 78this.renderContextHandleUser = NativeWrapper.EvtCreateRenderContext(0, null, UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextUser); 105UnsafeNativeMethods.EvtRpcLogin erLogin = new UnsafeNativeMethods.EvtRpcLogin( 116Handle = NativeWrapper.EvtOpenSession(UnsafeNativeMethods.EvtLoginClass.EvtRpcLogin, ref erLogin, 0, 0); 226UnsafeNativeMethods.EvtExportLogFlags flag = pathType switch 228PathType.LogName => UnsafeNativeMethods.EvtExportLogFlags.EvtExportLogChannelPath, 229PathType.FilePath => UnsafeNativeMethods.EvtExportLogFlags.EvtExportLogFilePath, 235NativeWrapper.EvtExportLog(this.Handle, path, query, targetFilePath, (int)flag | (int)UnsafeNativeMethods.EvtExportLogFlags.EvtExportLogTolerateQueryErrors);

136UnsafeNativeMethods.EvtClose(_eventsBuffer[i]); 160flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeStartAfterBookmark; 164flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeStartAtOldestRecord; 168flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeToFutureEvents; 173flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeTolerateQueryErrors; 187_handle = UnsafeNativeMethods.EvtSubscribe(_eventQuery.Session.Handle,

58EventLogHandle handle = UnsafeNativeMethods.EvtQuery(session, path, query, flags); 74UnsafeNativeMethods.EvtSeekFlags flags) 76bool status = UnsafeNativeMethods.EvtSeek(resultSet, position, bookmark, timeout, flags); 90bool status = UnsafeNativeMethods.EvtNext(queryHandle, eventSize, events, timeout, flags, ref returned); 99if (!UnsafeNativeMethods.EvtCancel(handle)) 112UnsafeNativeMethods.EvtClose(handle); 124EventLogHandle handle = UnsafeNativeMethods.EvtOpenPublisherMetadata(session, ProviderId, logFilePath, 0, flags); 139bool status = UnsafeNativeMethods.EvtGetObjectArraySize(objectArray, out arraySize); 148EventLogHandle emEnumHandle = UnsafeNativeMethods.EvtOpenEventMetadataEnum(ProviderMetadata, flags); 162EventLogHandle emHandle = UnsafeNativeMethods.EvtNextEventMetadata(eventMetadataEnum, flags); 178EventLogHandle channelEnum = UnsafeNativeMethods.EvtOpenChannelEnum(session, flags); 191EventLogHandle pubEnum = UnsafeNativeMethods.EvtOpenPublisherEnum(session, flags); 204EventLogHandle handle = UnsafeNativeMethods.EvtOpenChannelConfig(session, channelPath, flags); 217bool status = UnsafeNativeMethods.EvtSaveChannelConfig(channelConfig, flags); 225EventLogHandle logHandle = UnsafeNativeMethods.EvtOpenLog(session, path, flags); 244status = UnsafeNativeMethods.EvtExportLog(session, channelPath, query, targetFilePath, flags); 257status = UnsafeNativeMethods.EvtArchiveExportedLog(session, logFilePath, locale, flags); 270status = UnsafeNativeMethods.EvtClearLog(session, channelPath, targetFilePath, flags); 279UnsafeNativeMethods.EvtRenderContextFlags flags) 281EventLogHandle renderContextHandleValues = UnsafeNativeMethods.EvtCreateRenderContext(valuePathsCount, valuePaths, flags); 298UnsafeNativeMethods.EvtRenderFlags flags = UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventXml; 299bool status = UnsafeNativeMethods.EvtRender(context, eventHandle, flags, buffer.Length, buffer, out buffUsed, out _); 307status = UnsafeNativeMethods.EvtRender(context, eventHandle, flags, buffer.Length, buffer, out buffUsed, out _); 323public static EventLogHandle EvtOpenSession(UnsafeNativeMethods.EvtLoginClass loginClass, ref UnsafeNativeMethods.EvtRpcLogin login, int timeout, int flags) 325EventLogHandle handle = UnsafeNativeMethods.EvtOpenSession(loginClass, ref login, timeout, flags); 334EventLogHandle handle = UnsafeNativeMethods.EvtCreateBookmark(bookmarkXml); 347bool status = UnsafeNativeMethods.EvtUpdateBookmark(bookmark, eventHandle); 353public static object? EvtGetEventInfo(EventLogHandle handle, UnsafeNativeMethods.EvtEventPropertyId enumType) 360bool status = UnsafeNativeMethods.EvtGetEventInfo(handle, enumType, 0, IntPtr.Zero, out bufferNeeded); 371status = UnsafeNativeMethods.EvtGetEventInfo(handle, enumType, bufferNeeded, buffer, out bufferNeeded); 376UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(buffer); 386public static object? EvtGetQueryInfo(EventLogHandle handle, UnsafeNativeMethods.EvtQueryPropertyId enumType) 392bool status = UnsafeNativeMethods.EvtGetQueryInfo(handle, enumType, 0, IntPtr.Zero, ref bufferNeeded); 400status = UnsafeNativeMethods.EvtGetQueryInfo(handle, enumType, bufferNeeded, buffer, ref bufferNeeded); 405UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(buffer); 415public static object? EvtGetPublisherMetadataProperty(EventLogHandle pmHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId thePropertyId) 422bool status = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, 0, IntPtr.Zero, out bufferNeeded); 430status = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, bufferNeeded, buffer, out bufferNeeded); 435UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(buffer); 445internal static EventLogHandle EvtGetPublisherMetadataPropertyHandle(EventLogHandle pmHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId thePropertyId) 451bool status = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, 0, IntPtr.Zero, out bufferNeeded); 459status = UnsafeNativeMethods.EvtGetPublisherMetadataProperty(pmHandle, thePropertyId, 0, bufferNeeded, buffer, out bufferNeeded); 471UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(buffer); 486bool status = UnsafeNativeMethods.EvtFormatMessage(handle, EventLogHandle.Zero, msgId, 0, null, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageId, 0, emptyBuffer, out bufferNeeded); 490if (!status && error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_VALUE_INSERT 491&& error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_PARAMETER_INSERT 492&& error != UnsafeNativeMethods.ERROR_EVT_MAX_INSERTS_REACHED) 503status = UnsafeNativeMethods.EvtFormatMessage(handle, EventLogHandle.Zero, msgId, 0, null, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageId, bufferNeeded, buffer, out bufferNeeded); 506if (!status && error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_VALUE_INSERT 507&& error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_PARAMETER_INSERT 508&& error != UnsafeNativeMethods.ERROR_EVT_MAX_INSERTS_REACHED) 531bool status = UnsafeNativeMethods.EvtGetObjectArrayProperty(objArrayHandle, thePropertyId, index, 0, 0, IntPtr.Zero, out bufferNeeded); 540status = UnsafeNativeMethods.EvtGetObjectArrayProperty(objArrayHandle, thePropertyId, index, 0, bufferNeeded, buffer, out bufferNeeded); 545UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(buffer); 555public static object? EvtGetEventMetadataProperty(EventLogHandle handle, UnsafeNativeMethods.EvtEventMetadataPropertyId enumType) 562bool status = UnsafeNativeMethods.EvtGetEventMetadataProperty(handle, enumType, 0, 0, IntPtr.Zero, out bufferNeeded); 570status = UnsafeNativeMethods.EvtGetEventMetadataProperty(handle, enumType, 0, bufferNeeded, buffer, out bufferNeeded); 575UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(buffer); 585public static object? EvtGetChannelConfigProperty(EventLogHandle handle, UnsafeNativeMethods.EvtChannelConfigPropertyId enumType) 592bool status = UnsafeNativeMethods.EvtGetChannelConfigProperty(handle, enumType, 0, 0, IntPtr.Zero, out bufferNeeded); 600status = UnsafeNativeMethods.EvtGetChannelConfigProperty(handle, enumType, 0, bufferNeeded, buffer, out bufferNeeded); 612UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(buffer); 622public static void EvtSetChannelConfigProperty(EventLogHandle handle, UnsafeNativeMethods.EvtChannelConfigPropertyId enumType, object? val) 624UnsafeNativeMethods.EvtVariant varVal = default; 634case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigEnabled: 636varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean; 640case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelConfigAccess: 642varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString; 647case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigLogFilePath: 649varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString; 654case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigMaxSize: 656varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64; 660case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigLevel: 662varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32; 666case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelPublishingConfigKeywords: 668varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64; 672case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigRetention: 674varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean; 678case UnsafeNativeMethods.EvtChannelConfigPropertyId.EvtChannelLoggingConfigAutoBackup: 680varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean; 690varVal.Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeNull; 692bool status = UnsafeNativeMethods.EvtSetChannelConfigProperty(handle, enumType, 0, ref varVal); 702bool status = UnsafeNativeMethods.EvtNextChannelPath(handle, 0, null, out channelNameNeeded); 717status = UnsafeNativeMethods.EvtNextChannelPath(handle, channelNameNeeded, buffer, out channelNameNeeded); 733bool status = UnsafeNativeMethods.EvtNextPublisherId(handle, 0, null, out ProviderIdNeeded); 748status = UnsafeNativeMethods.EvtNextPublisherId(handle, ProviderIdNeeded, buffer, out ProviderIdNeeded); 760public static object? EvtGetLogInfo(EventLogHandle handle, UnsafeNativeMethods.EvtLogPropertyId enumType) 767bool status = UnsafeNativeMethods.EvtGetLogInfo(handle, enumType, 0, IntPtr.Zero, out bufferNeeded); 775status = UnsafeNativeMethods.EvtGetLogInfo(handle, enumType, bufferNeeded, buffer, out bufferNeeded); 780UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(buffer); 790public static void EvtRenderBufferWithContextSystem(EventLogHandle contextHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtRenderFlags flag, SystemProperties systemProperties) 799bool status = UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, 0, IntPtr.Zero, out bufferNeeded, out propCount); 808status = UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, bufferNeeded, buffer, out bufferNeeded, out propCount); 817UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(pointer); 820case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemProviderName: 821systemProperties.ProviderName = (string?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); 823case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemProviderGuid: 824systemProperties.ProviderId = (Guid?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); 826case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemEventID: 827systemProperties.Id = (ushort?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); 829case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemQualifiers: 830systemProperties.Qualifiers = (ushort?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); 832case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemLevel: 833systemProperties.Level = (byte?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); 835case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemTask: 836systemProperties.Task = (ushort?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16); 838case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemOpcode: 839systemProperties.Opcode = (byte?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); 841case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemKeywords: 842systemProperties.Keywords = (ulong?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt64); 844case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemTimeCreated: 845systemProperties.TimeCreated = (DateTime?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeFileTime); 847case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemEventRecordId: 848systemProperties.RecordId = (ulong?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64); 850case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemActivityID: 851systemProperties.ActivityId = (Guid?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); 853case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemRelatedActivityID: 854systemProperties.RelatedActivityId = (Guid?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid); 856case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemProcessID: 857systemProperties.ProcessId = (uint?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32); 859case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemThreadID: 860systemProperties.ThreadId = (uint?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32); 862case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemChannel: 863systemProperties.ChannelName = (string?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); 865case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemComputer: 866systemProperties.ComputerName = (string?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeString); 868case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemUserID: 869systemProperties.UserId = (SecurityIdentifier?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeSid); 871case (int)UnsafeNativeMethods.EvtSystemPropertyId.EvtSystemVersion: 872systemProperties.Version = (byte?)ConvertToObject(varVal, UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte); 896UnsafeNativeMethods.EvtRenderFlags flag = UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventValues; 900bool status = UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, 0, IntPtr.Zero, out bufferNeeded, out propCount); 909status = UnsafeNativeMethods.EvtRender(contextHandle, eventHandle, flag, bufferNeeded, buffer, out bufferNeeded, out propCount); 920UnsafeNativeMethods.EvtVariant varVal = Marshal.PtrToStructure<UnsafeNativeMethods.EvtVariant>(pointer); 934public static string? EvtFormatMessageRenderName(EventLogHandle pmHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags flag) 938bool status = UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, 0, emptyBuffer, out bufferNeeded); 941if (!status && error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_VALUE_INSERT 942&& error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_PARAMETER_INSERT) 959status = UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, bufferNeeded, buffer, out bufferNeeded); 962if (!status && error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_VALUE_INSERT 963&& error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_PARAMETER_INSERT) 986public static IEnumerable<string> EvtFormatMessageRenderKeywords(EventLogHandle pmHandle, EventLogHandle eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags flag) 995bool status = UnsafeNativeMethods.EvtFormatMessage(pmHandle, eventHandle, 0, 0, null, flag, 0, emptyBuffer, out bufferNeeded); 1009status = UnsafeNativeMethods.EvtFormatMessageBuffer(pmHandle, eventHandle, 0, 0, IntPtr.Zero, flag, bufferNeeded, buffer, out bufferNeeded); 1046UnsafeNativeMethods.EvtRenderFlags flag = UnsafeNativeMethods.EvtRenderFlags.EvtRenderBookmark; 1050bool status = UnsafeNativeMethods.EvtRender(EventLogHandle.Zero, eventHandle, flag, 0, IntPtr.Zero, out bufferNeeded, out propCount); 1059status = UnsafeNativeMethods.EvtRender(EventLogHandle.Zero, eventHandle, flag, bufferNeeded, buffer, out bufferNeeded, out propCount); 1079UnsafeNativeMethods.EvtStringVariant[] stringVariants = new UnsafeNativeMethods.EvtStringVariant[values.Length]; 1082stringVariants[i].Type = (uint)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString; 1086bool status = UnsafeNativeMethods.EvtFormatMessage(handle, eventHandle, 0xffffffff, values.Length, stringVariants, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageEvent, 0, emptyBuffer, out bufferNeeded); 1089if (!status && error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_VALUE_INSERT 1090&& error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_PARAMETER_INSERT) 1107status = UnsafeNativeMethods.EvtFormatMessage(handle, eventHandle, 0xffffffff, values.Length, stringVariants, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageEvent, bufferNeeded, buffer, out bufferNeeded); 1110if (!status && error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_VALUE_INSERT 1111&& error != UnsafeNativeMethods.ERROR_EVT_UNRESOLVED_PARAMETER_INSERT) 1127private static object? ConvertToObject(UnsafeNativeMethods.EvtVariant val) 1131case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32: 1133case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt32: 1135case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16: 1137case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt16: 1139case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte: 1141case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSByte: 1143case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64: 1145case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt64: 1147case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt64: 1149case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt32: 1151case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSingle: 1153case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeDouble: 1155case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeNull: 1157case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString: 1159case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeAnsiString: 1161case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSid: 1163case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid: 1165case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeEvtHandle: 1167case (int)(int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeFileTime: 1169case (int)(int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSysTime: 1170UnsafeNativeMethods.SystemTime sysTime = Marshal.PtrToStructure<UnsafeNativeMethods.SystemTime>(val.SystemTime); 1172case (int)(int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSizeT: 1174case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean: 1179case (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBinary: 1180case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeByte): 1186case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt16): 1192case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt32): 1198case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeInt64): 1204case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSingle): 1210case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeDouble): 1216case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSByte): 1218case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt16): 1220case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt64): 1221case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt64): 1223case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeUInt32): 1224case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeHexInt32): 1226case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeString): 1228case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeAnsiString): 1230case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBoolean): 1232case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeGuid): 1234case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeFileTime): 1236case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSysTime): 1238case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeBinary): // both length and count in the manifest: tracrpt supports, Crimson APIs don't 1239case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSizeT): // unused: array of win:pointer is returned as HexIntXX 1240case ((int)UnsafeNativeMethods.EvtMasks.EVT_VARIANT_TYPE_ARRAY | (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeSid): // unsupported by native APIs 1246public static object? ConvertToObject(UnsafeNativeMethods.EvtVariant val, UnsafeNativeMethods.EvtVariantType desiredType) 1248if (val.Type == (int)UnsafeNativeMethods.EvtVariantType.EvtVarTypeNull) 1256public static string? ConvertToString(UnsafeNativeMethods.EvtVariant val) 1264public static string? ConvertToAnsiString(UnsafeNativeMethods.EvtVariant val) 1272public static EventLogHandle ConvertToSafeHandle(UnsafeNativeMethods.EvtVariant val) 1280public static unsafe T[] ConvertToArray<T>(UnsafeNativeMethods.EvtVariant val) 1299public static unsafe bool[] ConvertToBoolArray(UnsafeNativeMethods.EvtVariant val) 1318public static unsafe DateTime[] ConvertToFileTimeArray(UnsafeNativeMethods.EvtVariant val) 1336public static unsafe DateTime[] ConvertToSysTimeArray(UnsafeNativeMethods.EvtVariant val) 1338UnsafeNativeMethods.SystemTime* ptr = (UnsafeNativeMethods.SystemTime*)val.Reference; 1348UnsafeNativeMethods.SystemTime sysTime = ptr[i]; 1355public static unsafe string?[] ConvertToStringArray(UnsafeNativeMethods.EvtVariant val, bool ansi) 1377case UnsafeNativeMethods.ERROR_EVT_MESSAGE_NOT_FOUND: 1378case UnsafeNativeMethods.ERROR_EVT_MESSAGE_ID_NOT_FOUND: 1379case UnsafeNativeMethods.ERROR_EVT_MESSAGE_LOCALE_NOT_FOUND: 1381case UnsafeNativeMethods.ERROR_MUI_FILE_NOT_FOUND:

88return (Guid)NativeWrapper.EvtGetPublisherMetadataProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataPublisherGuid)!; 96return (string?)NativeWrapper.EvtGetPublisherMetadataProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataMessageFilePath); 104return (string?)NativeWrapper.EvtGetPublisherMetadataProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataResourceFilePath); 112return (string?)NativeWrapper.EvtGetPublisherMetadataProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataParameterFilePath); 120string? helpLinkStr = (string?)NativeWrapper.EvtGetPublisherMetadataProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataHelpLink); 131return (uint)NativeWrapper.EvtGetPublisherMetadataProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataPublisherMessageID)!; 160elHandle = NativeWrapper.EvtGetPublisherMetadataPropertyHandle(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferences); 168string? channelName = (string?)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferencePath); 170uint channelId = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceID)!; 172uint flag = (uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceFlags)!; 175if (flag == (int)UnsafeNativeMethods.EvtChannelReferenceFlags.EvtChannelReferenceImported) 180int channelRefMessageId = unchecked((int)((uint)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataChannelReferenceMessageID)!)); 240_standardLevels ??= (List<EventLevel>)GetProviderListProperty(_defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels)!; 250_standardOpcodes ??= (List<EventOpcode>)GetProviderListProperty(_defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes)!; 260_standardKeywords ??= (List<EventKeyword>)GetProviderListProperty(_defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords)!; 270_standardTasks ??= (List<EventTask>)GetProviderListProperty(_defaultProviderHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks)!; 279internal object? GetProviderListProperty(EventLogHandle providerHandle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId metadataProperty) 285UnsafeNativeMethods.EvtPublisherMetadataPropertyId propName; 286UnsafeNativeMethods.EvtPublisherMetadataPropertyId propValue; 287UnsafeNativeMethods.EvtPublisherMetadataPropertyId propMessageId; 301case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels: 302propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelName; 303propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelValue; 304propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevelMessageID; 309case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes: 310propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeName; 311propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeValue; 312propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodeMessageID; 317case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords: 318propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordName; 319propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordValue; 320propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywordMessageID; 325case UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks: 326propName = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskName; 327propValue = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskValue; 328propMessageId = UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskMessageID; 391Guid taskGuid = (Guid)NativeWrapper.EvtGetObjectArrayProperty(elHandle, index, (int)UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTaskEventGuid)!; 424el = (List<EventLevel>)this.GetProviderListProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataLevels)!; 441eo = (List<EventOpcode>)this.GetProviderListProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataOpcodes)!; 458ek = (List<EventKeyword>)this.GetProviderListProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataKeywords)!; 475et = (List<EventTask>)this.GetProviderListProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks)!; 502uint emId = (uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventID)!; 503byte emVersion = (byte)((uint)(NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventVersion))!); 504byte emChannelId = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventChannel)!); 505byte emLevel = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventLevel)!); 506byte emOpcode = (byte)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventOpcode)!); 507short emTask = (short)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventTask)!); 508long emKeywords = (long)(ulong)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventKeyword)!; 509string? emTemplate = (string?)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventTemplate); 510int messageId = (int)((uint)NativeWrapper.EvtGetEventMetadataProperty(emHandle, UnsafeNativeMethods.EvtEventMetadataPropertyId.EventMetadataEventMessageID)!); 531this.GetProviderListProperty(_handle, UnsafeNativeMethods.EvtPublisherMetadataPropertyId.EvtPublisherMetadataTasks);

188return NativeWrapper.EvtFormatMessageRenderName(pm.Handle, eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageEvent); 220return NativeWrapper.EvtFormatMessageRenderName(pm.Handle, eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageLevel); 230return NativeWrapper.EvtFormatMessageRenderName(pm.Handle, eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageOpcode); 240return NativeWrapper.EvtFormatMessageRenderName(pm.Handle, eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageTask); 250return NativeWrapper.EvtFormatMessageRenderKeywords(pm.Handle, eventHandle, UnsafeNativeMethods.EvtFormatMessageFlags.EvtFormatMessageKeyword);