CF_EV_SCOPE clipboard format

The CF_EV_SCOPE clipboard format returns settings information, such as which event log is being viewed. This clipboard format applies only to the Scope node type.

Data Format

The following example shows the display of the data provided by this clipboard format.

ULONG   flViewFlags,
ULONG   ulType,
USHORT  cchServerName,
WCHAR   wszServerName[],
USHORT  cchLogName,
WCHAR   wszLogName[],
USHORT  cchFileName,
WCHAR   wszFileName[],
USHORT  cchDisplayName,
WCHAR   wszDisplayName[]

Members

flViewFlags

Describes the view. This value is a bitwise OR of zero or more of the following flags.

Flag	Value	Description
VIEWINFO_BACKUP	0x0001	The view is for an archived .evt file. The Event Log service is not actively using this file, and the Event Viewer snap-in will not offer commands for configuring or clearing this file.
VIEWINFO_FILTERED	0x0002	The view is filtered. Use the CF_EV_SCOPE_FILTER clipboard format to retrieve the filter settings.
VIEWINFO_LOW_SPEED	0x0004	The event log is being accessed over a low-speed connection.
VIEWINFO_USER_CREATED	0x0008	The view was created by the user using the New View command. If this flag is not set, then the event log was discovered by enumeration of the log keys in the registry.
VIEWINFO_ALLOW_DELETE	0x0100	The user can delete the view.
VIEWINFO_DISABLED	0x0200	The event log is disabled due to an error while attempting to access the log. If the user selects the Refresh command, this flag is cleared.
VIEWINFO_READ_ONLY	0x0400	The console process has read-only access to the event log.
VIEWINFO_DONT_PERSIST	0x0800	The view is not saved to the console file.

 

ulType

A value that specifies the event log type. This member can be one of the following values.

Event log type	Value	Description
ELT_APPLICATION	103	Application log.
ELT_CUSTOM	104	All other logs besides the Application, Security or System logs.
ELT_SECURITY	102	Security log.
ELT_SYSTEM	101	System log.

 

cchServerName

Number of characters, including the terminating null character, in wszServerName.

wszServerName

Null-terminated Unicode string specifying the computer name. If the selected node is for the local computer, then wszServername will be an empty string, L"", and cchServerName will be 1.

cchLogName

Number of characters, including the terminating null character, in wszLogName.

wszLogName

Null-terminated Unicode string specifying the event log name.

cchFileName

Number of characters, including the terminating null character, in wszFileName.

wszFileName

Null-terminated Unicode string specifying the event log file name. If the selected node is for a remote computer, then wszFileName is a Universal Naming Convention (UNC) path to the event log file. The path contains an administrative share, for example, "\\myserver\C$\windows\system32\config\application.evt". Be aware that the console process may not have access permission to the event log file. If the selected node is for the local computer, the path is based on the local drive, for example, "c:\windows\system32\config\application.evt".

cchDisplayName

Number of characters, including the terminating null character, in wszDisplayName.

wszDisplayName

Null-terminated Unicode string specifying the event log display name. This member is the name of the view's scope item.

Note

On 64-bit platforms, padding may be used by the CF_EV_SCOPE clipboard format so that the data is naturally aligned. For example, padding could occur at the end of a string if the string contains an odd number of wide characters.