EvtGetEventMetadataProperty function

Gets the specified event metadata property.

Syntax

BOOL EvtGetEventMetadataProperty(
  EVT_HANDLE                     EventMetadata,
  EVT_EVENT_METADATA_PROPERTY_ID PropertyId,
  DWORD                          Flags,
  DWORD                          EventMetadataPropertyBufferSize,
  PEVT_VARIANT                   EventMetadataPropertyBuffer,
  PDWORD                         EventMetadataPropertyBufferUsed
);

Parameters

EventMetadata

A handle to the event metadata that the EvtNextEventMetadata function returns.

PropertyId

The identifier of the metadata property to retrieve. For a list of property identifiers, see the EVT_EVENT_METADATA_PROPERTY_ID enumeration.

Flags

Reserved. Must be zero.

EventMetadataPropertyBufferSize

The size of the EventMetadataPropertyBuffer buffer, in bytes.

EventMetadataPropertyBuffer

A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

EventMetadataPropertyBufferUsed

The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

Return Value

Return code/value Description
TRUE
The function succeeded.
FALSE
The function failed. To get the error code, call the GetLastError function.

Requirements

   
Minimum supported client Windows Vista [desktop apps only]
Minimum supported server Windows Server 2008 [desktop apps only]
Target Platform Windows
Header winevt.h
Library Wevtapi.lib
DLL Wevtapi.dll

See Also

EvtGetPublisherMetadataProperty

EvtNextEventMetadata