>I can't find any source code that gets the actual event log data.
>I currently have:
>dwRet = ReadEventLog(hEventLog, EVENTLOG_SEEK_READ Or EVENTLOG_FORWARDS_READ, i, evlr, 0, cbRead, cbNeeded)
>
>and in "evlr" contains everything but the real Raw Data.
>
>Can anybody please let me know how to extract the string/raw data from the event logs?
>
>Email me at georgev@lancentre.com.au if you want to email the code.
>
>thanks.

What does the declaration for ReadEventLog look like? Is evlr passed by reference?