[Win32utils-devel] Problem reading log with win32-eventlog - buffer too small

Daniel Berger djberg96 at gmail.com
Sat May 17 15:38:40 EDT 2008

Hi all,

A user recently ran into an issue with win32-eventlog and the 
EventLog#read method when reading a saved log file. It seems that 
there's an issue.

After some experimentation I found that the problem seems to be that the 
initial buffer to ReadEventLog() in line 558 is too small, so it tries a 
second call to ReadEventLog() with a larger buffer. The problem is that, 
after I added some error checking code there, the second attempt returns:

"The data area passed to a system call is too small"

What I can't figure out is why it's failing. The buffer is plenty big, 
and I even tried setting it to the max value (0x7ffff bytes), but I 
still get that error.

Any ideas? I've attached the log file in question. The error happens 
right after log entry 136.

BTW, I've added some error handling in CVS, so please checkout the 
latest code.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: AppEvent.evt
Type: application/octet-stream
Size: 373748 bytes
Desc: not available
URL: <http://rubyforge.org/pipermail/win32utils-devel/attachments/20080517/82ff1deb/attachment-0001.obj>

More information about the win32utils-devel mailing list