讀取系統日誌eventlog記錄
阿新 • • 發佈:2019-01-27
檢視系統日誌的執行程式:eventvwr.msc
方法一 用API讀取
void DisplayEntries()
{
char *tempBuf=new char[100];
memset(tempBuf,0,100);
HANDLE h;
EVENTLOGRECORD *pevlr;
TCHAR bBuffer[4096] = {0};
DWORD dwRead, dwNeeded, cRecords, dwThisRecord = 0;
// Open the Application event log.
/*Windows 日誌: 應用程式 對應於OpenEventLog(NULL,"Application") 安全 對應於OpenEventLog(NULL,"Security") setup 系統 對應於OpenEventLog(NULL,"System")*/ h = OpenEventLog( NULL, /*use local computer*/ _T("System")); // source name : System. if (h == NULL) { printf("Could not open the Application event log."); } pevlr = (EVENTLOGRECORD *) &bBuffer; //GetOldestEventLogRecord(h, &dwThisRecord); // Opening the event log positions the file pointer for this // handle at the beginning of the log. Read the records // sequentially until there are no more. while (ReadEventLog(h, // event log handle EVENTLOG_FORWARDS_READ | // reads forward EVENTLOG_SEQUENTIAL_READ, // sequential read 0, // ignored for sequential reads pevlr, // pointer to buffer 4096, // size of buffer &dwRead, // number of bytes read &dwNeeded)) // bytes in next record { while (dwRead > 0) { // Print the event identifier, type, and source name. // The source name is just past the end of the formal structure. //_tprintf(_T("%02d Event ID: 0x%08X "), dwThisRecord++, pevlr->EventID); _tprintf(_T("%02d Event ID: %08d "), dwThisRecord++, pevlr->EventID); _tprintf(_T("EventType: %d Source: %s\n"), pevlr->EventType, (LPCTSTR)((LPBYTE) pevlr + sizeof(EVENTLOGRECORD))); dwRead -= pevlr->Length; pevlr = (EVENTLOGRECORD *) ((LPBYTE) pevlr + pevlr->Length); } pevlr = (EVENTLOGRECORD *) &bBuffer; } CloseEventLog(h); }
這個方法讀出來的記錄有個問題,source是eventlog的記錄,eventID的值都不對。比如6005,是2147477642.。而其它來源的記錄不會有問題
方法二 .net 提供的類EventLog
msdn上 eventlog類的介紹:
double DiffSec=0; EventLog e = new EventLog(); e.Log = "System"; foreach (EventLogEntry l in e.Entries) { if (l.EventID == 6006) // shutdown { Console.WriteLine( "關機時間:"+ l.TimeGenerated ); year = l.TimeGenerated.Year; month = l.TimeGenerated.Month; day = l.TimeGenerated.Day; hour = l.TimeGenerated.Hour; min = l.TimeGenerated.Minute; sec = l.TimeGenerated.Second; } if (l.EventID == 6005) // shutup { Console.WriteLine("開機時間:" + l.TimeGenerated); year2= l.TimeGenerated.Year; month2 = l.TimeGenerated.Month; day2 = l.TimeGenerated.Day; hour2 = l.TimeGenerated.Hour; min2 = l.TimeGenerated.Minute; sec2 = l.TimeGenerated.Second; } } if ((year == 0) | (year2 == 0)) { Console.WriteLine("error"); return 1; } else { System.DateTime ShutdownTime = new DateTime(year, month, day, hour, min, sec); System.DateTime ShutupTime = new DateTime(year2, month2, day2, hour2, min2, sec2); System.TimeSpan diff2 = ShutupTime - ShutdownTime; DiffSec = diff2.TotalSeconds; if (DiffSec >= int.Parse(args[0])) { Console.WriteLine("0"); return 0; } else { Console.WriteLine("1"); return 1; } }