ELF_EOF_RECORD structure

Contains information that is included immediately after the newest event log record.

The ELF_EOF_RECORD structure is used in an event log to enable the event-logging service to recontruct the ELF_LOGFILE_HEADER. The event-logging service must add the ELF_EOF_RECORD to the event log. For more information about ELF_EOF_RECORD, see Event Log File Format.

Syntax

typedef struct _EVENTLOGEOF {
  ULONG RecordSizeBeginning;
  ULONG One;
  ULONG Two;
  ULONG Three;
  ULONG Four;
  ULONG BeginRecord;
  ULONG EndRecord;
  ULONG CurrentRecordNumber;
  ULONG OldestRecordNumber;
  ULONG RecordSizeEnd;
} EVENTLOGEOF, *PEVENTLOGEOF;

Members

• RecordSizeBeginning
  The beginning size of the ELF_EOF_RECORD. The beginning size is always 0x28.

• One
  An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x11111111.

• Two
  An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x22222222.

• Three
  An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x33333333.

• Four
  An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x44444444.

• BeginRecord
  The offset to the oldest record. If the event log is empty, this is set to the start of this structure.

• EndRecord
  The offset to the start of this structure.

• CurrentRecordNumber
  The record number of the next event that will be written to the event log.

• OldestRecordNumber
  The record number of the oldest record in the event log. The record number will be 0 if the event log is empty.

• RecordSizeEnd
  The ending size of the ELF_EOF_RECORD. The ending size is always 0x28.

Remarks

If the event log is empty, the ELF_EOF_RECORD is written immediately after the ELF_LOGFILE_HEADER.

Requirements

See also

ELF_LOGFILE_HEADER

EVENTLOGRECORD

Event Log File Format