typedef struct _EVENTLOGRECORD {
  DWORD Length;
  DWORD Reserved;
  DWORD RecordNumber;
  DWORD TimeGenerated;
  DWORD TimeWritten;
  DWORD EventID;
  WORD  EventType;
  WORD  NumStrings;
  WORD  EventCategory;
  WORD  ReservedFlags;
  DWORD ClosingRecordNumber;
  DWORD StringOffset;
  DWORD UserSidLength;
  DWORD UserSidOffset;
  DWORD DataLength;
  DWORD DataOffset;
} EVENTLOGRECORD, *PEVENTLOGRECORD;

typedef struct _EVENTLOG_FULL_INFORMATION {
  DWORD dwFull;
} EVENTLOG_FULL_INFORMATION, *LPEVENTLOG_FULL_INFORMATION;


typedef enum _EVT_VARIANT_TYPE {
  EvtVarTypeNull        = 0,
  EvtVarTypeString      = 1,
  EvtVarTypeAnsiString  = 2,
  EvtVarTypeSByte       = 3,
  EvtVarTypeByte        = 4,
  EvtVarTypeInt16       = 5,
  EvtVarTypeUInt16      = 6,
  EvtVarTypeInt32       = 7,
  EvtVarTypeUInt32      = 8,
  EvtVarTypeInt64       = 9,
  EvtVarTypeUInt64      = 10,
  EvtVarTypeSingle      = 11,
  EvtVarTypeDouble      = 12,
  EvtVarTypeBoolean     = 13,
  EvtVarTypeBinary      = 14,
  EvtVarTypeGuid        = 15,
  EvtVarTypeSizeT       = 16,
  EvtVarTypeFileTime    = 17,
  EvtVarTypeSysTime     = 18,
  EvtVarTypeSid         = 19,
  EvtVarTypeHexInt32    = 20,
  EvtVarTypeHexInt64    = 21,
  EvtVarTypeEvtHandle   = 32,
  EvtVarTypeEvtXml      = 35
} EVT_VARIANT_TYPE;




union _ANON_evt_variant_sub_union {
    BOOL       BooleanVal;
    INT8       SByteVal;
    INT16      Int16Val;
    INT32      Int32Val;
    INT64      Int64Val;
    UINT8      ByteVal;
    UINT16     UInt16Val;
    UINT32     UInt32Val;
    UINT64     UInt64Val;
    FLOAT      SingleVal;
    DOUBLE     DoubleVal;
    ULONGLONG  FileTimeVal;
    SYSTEMTIME *SysTimeVal;
    GUID       *GuidVal;
    LPCWSTR    StringVal;
    LPCSTR     AnsiStringVal;
    PBYTE      BinaryVal;
    PSID       SidVal;
    SIZE_T     SizeTVal;
    EVT_HANDLE EvtHandleVal;
    BOOL       *BooleanArr;
    INT8       *SByteArr;
    INT16      *Int16Arr;
    INT32      *Int32Arr;
    INT64      *Int64Arr;
    UINT8      *ByteArr;
    UINT16     *UInt16Arr;
    UINT32     *UInt32Arr;
    UINT64     *UInt64Arr;
    FLOAT      *SingleArr;
    DOUBLE     *DoubleArr;
    FILETIME   *FileTimeArr;
    SYSTEMTIME *SysTimeArr;
    GUID       *GuidArr;
    LPWSTR     *StringArr;
    LPSTR      *AnsiStringArr;
    PSID       *SidArr;
    SIZE_T     *SizeTArr;
    LPCWSTR    XmlVal;
    LPCWSTR*   XmlValArr;
  };

typedef struct _EVT_VARIANT {
  _ANON_evt_variant_sub_union _VARIANT_VALUE;
  DWORD Count;
  DWORD Type;
} EVT_VARIANT, *PEVT_VARIANT;


typedef enum _EVT_RENDER_CONTEXT_FLAGS {
  EvtRenderContextValues  = 0,
  EvtRenderContextSystem  = 1,
  EvtRenderContextUser    = 2
} EVT_RENDER_CONTEXT_FLAGS;


typedef enum  _EVT_SYSTEM_PROPERTY_ID {
  EvtSystemProviderName,
  EvtSystemProviderGuid,
  EvtSystemEventID,
  EvtSystemQualifiers,
  EvtSystemLevel,
  EvtSystemTask,
  EvtSystemOpcode,
  EvtSystemKeywords,
  EvtSystemTimeCreated,
  EvtSystemEventRecordId,
  EvtSystemActivityID,
  EvtSystemRelatedActivityID,
  EvtSystemProcessID,
  EvtSystemThreadID,
  EvtSystemChannel,
  EvtSystemComputer,
  EvtSystemUserID,
  EvtSystemVersion,
  EvtSystemPropertyIdEND
} EVT_SYSTEM_PROPERTY_ID;


typedef enum _EVT_RENDER_FLAGS {
  EvtRenderEventValues  = 0,
  EvtRenderEventXml     = 1,
  EvtRenderBookmark     = 2
} EVT_RENDER_FLAGS;


typedef enum _EVT_QUERY_FLAGS {
  EvtQueryChannelPath          = 0x1,
  EvtQueryFilePath             = 0x2,
  EvtQueryForwardDirection     = 0x100,
  EvtQueryReverseDirection     = 0x200,
  EvtQueryTolerateQueryErrors  = 0x1000
} EVT_QUERY_FLAGS;


typedef enum _EVT_LOG_PROPERTY_ID {
  EvtLogCreationTime        = 0,
  EvtLogLastAccessTime      = 1,
  EvtLogLastWriteTime       = 2,
  EvtLogFileSize            = 3,
  EvtLogAttributes          = 4,
  EvtLogNumberOfLogRecords  = 5,
  EvtLogOldestRecordNumber  = 6,
  EvtLogFull                = 7
} EVT_LOG_PROPERTY_ID;

typedef enum _EVT_OPEN_LOG_FLAGS {
  EvtOpenChannelPath  = 0x1,
  EvtOpenFilePath     = 0x2
} EVT_OPEN_LOG_FLAGS;


typedef enum _EVT_CHANNEL_CONFIG_PROPERTY_ID {
  EvtChannelConfigEnabled                = 0,
  EvtChannelConfigIsolation              = 1,
  EvtChannelConfigType                   = 2,
  EvtChannelConfigOwningPublisher        = 3,
  EvtChannelConfigClassicEventlog        = 4,
  EvtChannelConfigAccess                 = 5,
  EvtChannelLoggingConfigRetention       = 6,
  EvtChannelLoggingConfigAutoBackup      = 7,
  EvtChannelLoggingConfigMaxSize         = 8,
  EvtChannelLoggingConfigLogFilePath     = 9,
  EvtChannelPublishingConfigLevel        = 10,
  EvtChannelPublishingConfigKeywords     = 11,
  EvtChannelPublishingConfigControlGuid  = 12,
  EvtChannelPublishingConfigBufferSize   = 13,
  EvtChannelPublishingConfigMinBuffers   = 14,
  EvtChannelPublishingConfigMaxBuffers   = 15,
  EvtChannelPublishingConfigLatency      = 16,
  EvtChannelPublishingConfigClockType    = 17,
  EvtChannelPublishingConfigSidType      = 18,
  EvtChannelPublisherList                = 19,
  EvtChannelPublishingConfigFileMax      = 20,
  EvtChannelConfigPropertyIdEND          = 21
} EVT_CHANNEL_CONFIG_PROPERTY_ID;


typedef enum  _EVT_CHANNEL_TYPE{
  EvtChannelTypeAdmin        = 0,
  EvtChannelTypeOperational  = 1,
  EvtChannelTypeAnalytic     = 2,
  EvtChannelTypeDebug        = 3
} EVT_CHANNEL_TYPE;

typedef enum  _EVT_CHANNEL_ISOLATION_TYPE{
  EvtChannelIsolationTypeApplication  = 0,
  EvtChannelIsolationTypeSystem       = 1,
  EvtChannelIsolationTypeCustom       = 2
} EVT_CHANNEL_ISOLATION_TYPE;


typedef enum _EVT_EVENT_METADATA_PROPERTY_ID {
  EventMetadataEventID           = 0,
  EventMetadataEventVersion      = 1,
  EventMetadataEventChannel      = 2,
  EventMetadataEventLevel        = 3,
  EventMetadataEventOpcode       = 4,
  EventMetadataEventTask         = 5,
  EventMetadataEventKeyword      = 6,
  EventMetadataEventMessageID    = 7,
  EventMetadataEventTemplate     = 8,
  EvtEventMetadataPropertyIdEND  = 9
} EVT_EVENT_METADATA_PROPERTY_ID;


typedef enum _EVT_PUBLISHER_METADATA_PROPERTY_ID {
  EvtPublisherMetadataPublisherGuid,
  EvtPublisherMetadataResourceFilePath,
  EvtPublisherMetadataParameterFilePath,
  EvtPublisherMetadataMessageFilePath,
  EvtPublisherMetadataHelpLink,
  EvtPublisherMetadataPublisherMessageID,
  EvtPublisherMetadataChannelReferences,
  EvtPublisherMetadataChannelReferencePath,
  EvtPublisherMetadataChannelReferenceIndex,
  EvtPublisherMetadataChannelReferenceID,
  EvtPublisherMetadataChannelReferenceFlags,
  EvtPublisherMetadataChannelReferenceMessageID,
  EvtPublisherMetadataLevels,
  EvtPublisherMetadataLevelName,
  EvtPublisherMetadataLevelValue,
  EvtPublisherMetadataLevelMessageID,
  EvtPublisherMetadataTasks,
  EvtPublisherMetadataTaskName,
  EvtPublisherMetadataTaskEventGuid,
  EvtPublisherMetadataTaskValue,
  EvtPublisherMetadataTaskMessageID,
  EvtPublisherMetadataOpcodes,
  EvtPublisherMetadataOpcodeName,
  EvtPublisherMetadataOpcodeValue,
  EvtPublisherMetadataOpcodeMessageID,
  EvtPublisherMetadataKeywords,
  EvtPublisherMetadataKeywordName,
  EvtPublisherMetadataKeywordValue,
  EvtPublisherMetadataKeywordMessageID,
  EvtPublisherMetadataPropertyIdEND
} EVT_PUBLISHER_METADATA_PROPERTY_ID;


typedef enum _EVT_FORMAT_MESSAGE_FLAGS {
  EvtFormatMessageEvent     = 1,
  EvtFormatMessageLevel     = 2,
  EvtFormatMessageTask      = 3,
  EvtFormatMessageOpcode    = 4,
  EvtFormatMessageKeyword   = 5,
  EvtFormatMessageChannel   = 6,
  EvtFormatMessageProvider  = 7,
  EvtFormatMessageId        = 8,
  EvtFormatMessageXml       = 9
} EVT_FORMAT_MESSAGE_FLAGS;

