I can't find any source code that gets the actual event log data.
I currently have:
dwRet = ReadEventLog(hEventLog, EVENTLOG_SEEK_READ Or EVENTLOG_FORWARDS_READ, i, evlr, 0, cbRead, cbNeeded)

and in "evlr" contains everything but the real Raw Data.

Can anybody please let me know how to extract the string/raw data from the event logs?

Email me at georgev@lancentre.com.au if you want to email the code.

thanks.