EVENTLOGRECORD Y2038 issue

2024-06-05T07:20:22.4466667+00:00

Dear Microsoft colleague,

The question is about _EVENTLOGRECORD structure.

typedef struct _EVENTLOGRECORD {

DWORD Length; DWORD Reserved;

DWORD RecordNumber;

DWORD TimeGenerated;

DWORD TimeWritten;

DWORD EventID;

WORD EventType;

WORD NumStrings;

WORD EventCategory;

WORD ReservedFlags;

DWORD ClosingRecordNumber;

DWORD StringOffset;

DWORD UserSidLength;

DWORD UserSidOffset;

DWORD DataLength;

DWORD DataOffset; } EVENTLOGRECORD, *PEVENTLOGRECORD;

TimeGenerated

The time at which this entry was submitted. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.

TimeWritten

The time at which this entry was received by the service to be written to the log. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.

The TimeGenerated and TimeWritten seems not Y2038 safe. Is there a new C++ API/struct that address this issue?

In a future time > Y2038 (and < 2100), is it still possible to get correct TimeGenerated with this structure? e.g.

CTime a64Time ( (time_t)pEventLogRecord->TimeGenerated).

Thank you!

Yuhong

Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,493 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. 2024-06-06T02:30:29.5133333+00:00

    typedef unsigned long DWORD, *PDWORD, *LPDWORD;

    TimeGenerated and TimeWritten are defined as unsigned long, so it should still work correctly for quite some years after Y2038.

    1 person found this answer helpful.
    0 comments No comments

  2. Xiaopo Yang - MSFT 12,151 Reputation points Microsoft Vendor
    2024-06-06T03:06:53.8933333+00:00

    Hello @Sun, Yu Hong (ADV D AA CN DIH RDH DIV),

    Such fields are as log information. It should have no impact on the system while EVENTLOGRECORD structure doesn't involve this condition. You can also submit document feedback about this concern.

    User's image

    0 comments No comments