ELF_EOF_RECORD structure

Contains information that is included immediately after the newest event log record.

The ELF_EOF_RECORD structure is used in an event log to enable the event-logging service to recontruct the ELF_LOGFILE_HEADER. The event-logging service must add the ELF_EOF_RECORD to the event log. For more information about ELF_EOF_RECORD, see Event Log File Format.

Syntax

typedef struct _EVENTLOGEOF {
 ULONG RecordSizeBeginning;
 ULONG One;
 ULONG Two;
 ULONG Three;
 ULONG Four;
 ULONG BeginRecord;
 ULONG EndRecord;
 ULONG CurrentRecordNumber;
 ULONG OldestRecordNumber;
 ULONG RecordSizeEnd;
} EVENTLOGEOF, *PEVENTLOGEOF;

Members

• RecordSizeBeginning
  The beginning size of the ELF_EOF_RECORD. The beginning size is always 0x28.

• One
  An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x11111111.

• Two
  An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x22222222.

• Three
  An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x33333333.

• Four
  An identifier that helps to differentiate this record from other records in the event log. The value is always set to 0x44444444.

• BeginRecord
  The offset to the oldest record. If the event log is empty, this is set to the start of this structure.

• EndRecord
  The offset to the start of this structure.

• CurrentRecordNumber
  The record number of the next event that will be written to the event log.

• OldestRecordNumber
  The record number of the oldest record in the event log. The record number will be 0 if the event log is empty.

• RecordSizeEnd
  The ending size of the ELF_EOF_RECORD. The ending size is always 0x28.

Remarks

If the event log is empty, the ELF_EOF_RECORD is written immediately after the ELF_LOGFILE_HEADER.

Requirements

See also

ELF_LOGFILE_HEADER

EVENTLOGRECORD

Event Log File Format