Here is a bit of the code I've modified to read the latest 20 entries of a an event log that is not full:
CODE#include <A3LEventLog.au3>
Dim $hEventLog, $aData, $sData
Dim $iI, $iJ, $iCount, $aEvent, $logfile, $ioffset, $pad
$logfile = FileOpen("temp.txt", 2)
$hEventLog = _EventLog_Open("", "System")
$hEventLog = _EventLog_Open("", "System")
$iCount = _EventLog_Count($hEventLog)
_Lib_ConsoleWrite("Record count ......: " & $iCount )
_Lib_ConsoleWrite("Oldest record .....: " & _EventLog_Oldest($hEventLog))
_Lib_ConsoleWrite(@CR)
$ioffset = _EventLog_Oldest($hEventLog)
$pad = $iCount
$iCount = $ioffset + $pad
MsgBox(0, "$icount", $iCount)
for $iI = $iCount - 20 to $iCount
$aEvent = _EventLog_Read($hEventLog)
FileWriteLine($logfile, "Record number .....: " & $aEvent[ 1])
FileWriteLine($logfile, "Submitted .........: " & $aEvent[ 2] & " " & $aEvent[ 3])
FileWriteLine($logfile, "Generated .........: " & $aEvent[ 4] & " " & $aEvent[ 5])
FileWriteLine($logfile, "Event ID ..........: " & $aEvent[ 6])
FileWriteLine($logfile, "Type ..............: " & $aEvent[ 8])
FileWriteLine($logfile, "Category ..........: " & $aEvent[ 9])
FileWriteLine($logfile, "Source ............: " & $aEvent[10])
FileWriteLine($logfile, "Computer ..........: " & $aEvent[11])
FileWriteLine($logfile, "Username ..........: " & $aEvent[12])
FileWriteLine($logfile, "Description .......: " & $aEvent[13])
$sData = ""
$aData = $aEvent[14]
for $iJ = 1 to $aData[0]
$sData = $sData & Hex($aData[$iJ], 2) & " "
if Mod($iJ, 16) = 0 then $sData = $sData
next
if $sData <> "" then $sData = $sData
_Lib_ConsoleWrite("Data ..............: " & $sData)
_Lib_ConsoleWrite(@CR)
next
_EventLog_Close($hEventLog)
Pardon ignorance. I realize now that $icount doesn't control from where the Log reading will begin, it's all in _EventLog_Read($hEventLog), so where do I set this offset? As you can see I've tried to do so with $iCount and $ioffset, but all this does is control the number of events that will be read, not from where to start the reading. Once the offset is worked out, how do I tell _EventLog_Read($hEventLog) to sart from this offset?