#define STATUS_EVENTLOG_FILE_CHANGED ((NTSTATUS)0xC0000197L)
MessageId: STATUS_EVENTLOG_FILE_CHANGED MessageText: The logfile has changed between reads.