WinEvent Logs and QFileSystemWatcher

Question

I try to add WinEvent Logs Windows7 to QFileSystemWatcher.However, addPath() method return false value.

qDebug() << m_watcher->addPath("C:/Windows/System32/winevt/Logs/Application.evtx"); // false

The same i get after trying to add winevt folder:

qDebug() << m_watcher->addPath("C:/Windows/System32/winevt"); // false

Winevt folder has read-only attributes, and i can't modify it (after change,applying, closings and reopen attributes have old stay). I read in QFileSystemWatcher documentation:

Reasons for a watch failure are generally system-dependent, but may include the resource not existing, access failures, or the total watch count limit, if the platform has one.

But i have no idea how to find to source of failure and how it maybe fixed. Thanks in advance.

Are you running the app as administrator? – Apr 12 '15 at 20:51 — , Apr 12 '15 at 20:51
Yes, but it wasn't a reason. I find solution. – t3ft3l--i Apr 13 '15 at 17:33 — t3ft3l--i, Apr 13 '15 at 17:33

score 0 · Answer 1 · answered Apr 12 '15 at 22:08

I believe that you got a file system redirection on a 64 bits OS.

There are two ways to get around this:

1) Build your application as 64 bits. 2) Explicitly disable system redirection by calling Wow64DisableWow64FsRedirection.

If you go to the second solution and need your application running on Windows XP 32 bits, i suggest you to call the WinAPI dynamically like on the following example:

#include <qt_windows.h>

#if defined(_WIN32) //Check if program is compiled in 32 bits (64 bits does not have redirection)
    SYSTEM_INFO SystemInfo = {0};
    GetNativeSystemInfo(&SystemInfo);

    if (SystemInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64) //Check if processor is 64 bits
    {
        //Call the Wow64DisableWow64FsRedirection api dynamically
        typedef BOOL(STDAPICALLTYPE *tWow64DisableWow64FsRedirection)(PVOID);
        tWow64DisableWow64FsRedirection pWow64DisableWow64FsRedirection = (tWow64DisableWow64FsRedirection)QLibrary::resolve("Kernel32", "Wow64DisableWow64FsRedirection");
        if (pWow64DisableWow64FsRedirection)
            pWow64DisableWow64FsRedirection(NULL);
    }
#endif

score 0 · Accepted Answer · edited May 23 '17 at 10:24

0

Find solution at another forum, where user give a link.

Sysnative folder is able to access.

Thanks all.

edited May 23 '17 at 10:24

Community

1
1

answered Apr 13 '15 at 17:48

t3ft3l--i

1,372
1
14
21

WinEvent Logs and QFileSystemWatcher

2 Answers2