NT Event Log - How to pass more than one string to the ReportEvent API?

[s_townsend]

Does anyone know how to pass more than one string to the ReportEvent API when writing to the Windows NT Event Log?
There is an example in the Microsoft Knowledge Base, but it demonstrates how to pass one string using a string and not an array of strings.

There is a sample in MSDN , name pop3srv demo the use of multistring for reportevent. Following is extracted from events.c

DWORD
ReportServiceEvent(
IN WORD EventType,
IN DWORD EventId,
IN DWORD SizeOfRawData,
IN PVOID RawData,
IN DWORD NumberOfStrings,
...
)
{
va_list arglist;
ULONG i;
PWSTR Strings[ MAX_EVENT_STRINGS ];
DWORD rv;

if (!hEventLog)
{
DebugLog((DEB_ERROR, "Cannot log event, no handle!\n"));
return((DWORD)-1);
}

//
// We're not supposed to be logging this, so nuke it
//
if ((LoggingLevel & (1 << EventType)) == 0)
{
return(0);
}

//
// Look at the strings, if they were provided
//
va_start( arglist, NumberOfStrings );

if (NumberOfStrings > MAX_EVENT_STRINGS) {
NumberOfStrings = MAX_EVENT_STRINGS;
}

for (i=0; i<NumberOfStrings; i++) {
Strings[ i ] = va_arg( arglist, PWSTR );
}


//
// Report the event to the eventlog service
//

if (!ReportEvent( hEventLog,
EventType,
0, // event category
EventId,
NULL,
(WORD)NumberOfStrings,
SizeOfRawData,
Strings,
RawData) )
{
rv = GetLastError();
DebugLog((DEB_ERROR, "ReportEvent( %u ) failed - %u\n", EventId, GetLastError() ));

}
else
{
rv = ERROR_SUCCESS;
}

return rv;
}