Re: NT log file format?

["Paul M. Cardon" <pmarc () cmg fcnbd com>]

""Marcus J. Ranum" <mjr () nfr net>" thus spake unto me:
: Anyone got any pointers to C code for dissecting NT log
: file formats under UNIX? Or is that pretty much an insane/inane
: idea?

I'm not sure how useful that would be.  The NT event logs are not  
self-contained.  Most of the data structures are numeric values that  
reference information both in the registry and application/service dlls to  
minimize logging storage requirements and to keep the event log  
language-neutral to facilitate internationalization of text messages.  The  
Event Viewer app performs lookups that return text for the language of the  
logged on user if available.

However, the data structures used in an event log entry are documented in  
the header file winnt.h (available with Visual C++) and also in O'Reilly's  
Windows NT Event Logging.

-paul