I am learning how to use Windows event logging service.
MSDN:
RegisterEventSourceA function (winbase.h) - Win32 apps | Microsoft Docs[
^]
Eventlog Key - Win32 apps | Microsoft Docs
HANDLE RegisterEventSourceA(
[in] LPCSTR lpUNCServerName,
[in] LPCSTR lpSourceName
);
[in] lpSourceName
The name of the event source whose handle is to be retrieved. The source name must be a subkey of a log under the Eventlog registry key. Note that the Security log is for system use only.
Here, I am not clear if "a subkey" should be a direct subkey under the Eventlog or can be a nested one.
Let's assume "App1" is the event source name I will use from now on.
Below I see there happen to be three locations that "App1" is set:
HKEY_LOCAL_MACHINE
SYSTEM
CurrentControlSet
Services
Eventlog
Application
AppName
Security
System
App1
MyCustLog
App1
3rdPartyLog
App1
Now, in my program, I would call:
HANDLE hEvtSrc = RegisterEventSource(0, "App1");
My question is: Among those 3 App1 subkeys, which App1 will be matched to return its handle to hEvtSrc?
What I have tried:
I am trying to figure out myself, but am lost.