SUBBLOCK

Selection criteria sub-block structure.

typedef struct _SUBBLOCK {
  ULONG                  entry_attribute_ID;      /*  The identifier of a field within a log entry. */
  ULONG                  comparison_operator_ID;  /*  The identifier of a comparison operator. */
  ULONG                  comparison_data_length;  /*  The length of the comparison data. */
  PVOID                  comparison_data_ptr;
  struct _SUBBLOCK      *next_subblock;
} SUBBLOCK;

typedef   SUBBLOCK   * PSUBBLOCK ;

Note that the comparison_data_ptr can point to either ASCII or UniCode character data. The type of character data is determined by the packet_revision_number parameter of FILTERBLOCK.