EvtGetEventMetadataProperty function (winevt.h)

Gets the specified event metadata property.

Syntax

BOOL EvtGetEventMetadataProperty(
  [in]  EVT_HANDLE                     EventMetadata,
  [in]  EVT_EVENT_METADATA_PROPERTY_ID PropertyId,
  [in]  DWORD                          Flags,
  [in]  DWORD                          EventMetadataPropertyBufferSize,
  [in]  PEVT_VARIANT                   EventMetadataPropertyBuffer,
  [out] PDWORD                         EventMetadataPropertyBufferUsed
);

Parameters

[in] EventMetadata

A handle to the event metadata that the EvtNextEventMetadata function returns.

[in] PropertyId

The identifier of the metadata property to retrieve. For a list of property identifiers, see the EVT_EVENT_METADATA_PROPERTY_ID enumeration.

[in] Flags

Reserved. Must be zero.

[in] EventMetadataPropertyBufferSize

The size of the EventMetadataPropertyBuffer buffer, in bytes.

[in] EventMetadataPropertyBuffer

A caller-allocated buffer that will receive the metadata property. The buffer contains an EVT_VARIANT object. You can set this parameter to NULL to determine the required buffer size.

[out] EventMetadataPropertyBufferUsed

The size, in bytes, of the caller-allocated buffer that the function used or the required buffer size if the function fails with ERROR_INSUFFICIENT_BUFFER.

Return value

Requirements

See also

EvtGetPublisherMetadataProperty

EvtNextEventMetadata