EventLogException is missing the original win32 error code (#70629)

src/libraries/Common/src/Interop/Windows/Interop.Errors.cs

@@ -71,6 +71,7 @@ internal static partial class Errors
         internal const int ERROR_DDE_FAIL = 0x484;
         internal const int ERROR_DLL_NOT_FOUND = 0x485;
         internal const int ERROR_NOT_FOUND = 0x490;
+        internal const int ERROR_CANCELLED = 0x4C7;
         internal const int ERROR_NETWORK_UNREACHABLE = 0x4CF;
         internal const int ERROR_NON_ACCOUNT_SID = 0x4E9;
         internal const int ERROR_NOT_ALL_ASSIGNED = 0x514;
@@ -93,6 +94,15 @@ internal static partial class Errors
         internal const int ERROR_TRUSTED_RELATIONSHIP_FAILURE = 0x6FD;
         internal const int ERROR_RESOURCE_TYPE_NOT_FOUND = 0x715;
         internal const int ERROR_RESOURCE_LANG_NOT_FOUND = 0x717;
+        internal const int RPC_S_CALL_CANCELED = 0x71A;
         internal const int ERROR_NOT_A_REPARSE_POINT = 0x1126;
+        internal const int ERROR_EVT_QUERY_RESULT_STALE = 0x3AA3;
+        internal const int ERROR_EVT_QUERY_RESULT_INVALID_POSITION = 0x3AA4;
+        internal const int ERROR_EVT_INVALID_EVENT_DATA = 0x3A9D;
+        internal const int ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND = 0x3A9A;
+        internal const int ERROR_EVT_CHANNEL_NOT_FOUND = 0x3A9F;
+        internal const int ERROR_EVT_MESSAGE_NOT_FOUND = 0x3AB3;
+        internal const int ERROR_EVT_MESSAGE_ID_NOT_FOUND = 0x3AB4;
+        internal const int ERROR_EVT_PUBLISHER_DISABLED = 0x3ABD;
     }
 }

src/libraries/System.Diagnostics.EventLog/src/System.Diagnostics.EventLog.csproj

-<Project Sdk="Microsoft.NET.Sdk">
+<Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <TargetFrameworks>$(NetCoreAppCurrent)-windows;$(NetCoreAppCurrent);$(NetCoreAppMinimum)-windows;$(NetCoreAppMinimum);netstandard2.0;$(NetFrameworkMinimum)</TargetFrameworks>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
@@ -110,6 +110,8 @@ System.Diagnostics.EventLog</PackageDescription>
              Link="Common\Interop\Windows\Interop.Libraries.cs" />
     <Compile Include="$(CommonPath)System\Diagnostics\NetFrameworkUtils.cs"
              Link="Common\System\Diagnostics\NetFrameworkUtils.cs" />
+    <Compile Include="$(CommonPath)Interop\Windows\Interop.HRESULT_FROM_WIN32.cs"
+             Link="Common\Interop\Windows\Interop.HRESULT_FROM_WIN32.cs" />
   </ItemGroup>
 
   <ItemGroup Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net7.0'))">

src/libraries/System.Diagnostics.EventLog/src/System/Diagnostics/Reader/EventLogException.cs

@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 
 using System.ComponentModel;
+using System.IO;
 using System.Runtime.Serialization;
 
 namespace System.Diagnostics.Eventing.Reader
@@ -16,30 +17,30 @@ internal static void Throw(int errorCode)
         {
             switch (errorCode)
             {
-                case 2:
-                case 3:
-                case 15007:
-                case 15027:
-                case 15028:
-                case 15002:
+                case Interop.Errors.ERROR_FILE_NOT_FOUND:
+                case Interop.Errors.ERROR_PATH_NOT_FOUND:
+                case Interop.Errors.ERROR_EVT_CHANNEL_NOT_FOUND:
+                case Interop.Errors.ERROR_EVT_MESSAGE_NOT_FOUND:
+                case Interop.Errors.ERROR_EVT_MESSAGE_ID_NOT_FOUND:
+                case Interop.Errors.ERROR_EVT_PUBLISHER_METADATA_NOT_FOUND:
                     throw new EventLogNotFoundException(errorCode);
 
-                case 13:
-                case 15005:
+                case Interop.Errors.ERROR_INVALID_DATA:
+                case Interop.Errors.ERROR_EVT_INVALID_EVENT_DATA:
                     throw new EventLogInvalidDataException(errorCode);
 
-                case 1818: // RPC_S_CALL_CANCELED is converted to ERROR_CANCELLED
-                case 1223:
+                case Interop.Errors.RPC_S_CALL_CANCELED:
+                case Interop.Errors.ERROR_CANCELLED:
                     throw new OperationCanceledException();
 
-                case 15037:
+                case Interop.Errors.ERROR_EVT_PUBLISHER_DISABLED:
                     throw new EventLogProviderDisabledException(errorCode);
 
-                case 5:
+                case Interop.Errors.ERROR_ACCESS_DENIED:
                     throw new UnauthorizedAccessException();
 
-                case 15011:
-                case 15012:
+                case Interop.Errors.ERROR_EVT_QUERY_RESULT_STALE:
+                case Interop.Errors.ERROR_EVT_QUERY_RESULT_INVALID_POSITION:
                     throw new EventLogReadingException(errorCode);
 
                 default:
@@ -50,7 +51,11 @@ internal static void Throw(int errorCode)
         public EventLogException() { }
         public EventLogException(string message) : base(message) { }
         public EventLogException(string message, Exception innerException) : base(message, innerException) { }
-        protected EventLogException(int errorCode) { _errorCode = errorCode; }
+        protected EventLogException(int errorCode)
+        {
+            _errorCode = errorCode;
+            HResult = Interop.HRESULT_FROM_WIN32(errorCode);
+        }
 
         public override string Message
         {

src/libraries/System.Diagnostics.EventLog/tests/System/Diagnostics/Reader/EventLogSessionTests.cs

@@ -106,5 +106,17 @@ public void ClearLog_LogExists_Success()
                 session.CancelCurrentOperations();
             }
         }
+
+        [ConditionalFact(typeof(Helpers), nameof(Helpers.SupportsEventLogs))]
+        [SkipOnTargetFramework(TargetFrameworkMonikers.NetFramework)]
+        public void EventLogExceptionShouldHaveHResultSet()
+        {
+            using (var session = new EventLogSession())
+            {
+                EventLogNotFoundException exception = Assert.Throws<EventLogNotFoundException>(() => session.ExportLog(LogName, PathType.FilePath, LogName, GetTestFilePath()));
+                Assert.Equal(unchecked((int)0x80070002), exception.HResult);
+                session.CancelCurrentOperations();
+            }
+        }
     }
 }