<转载> 读取Windows日志

// readlog.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>

BOOL Event(char *szLog,DWORD dwType);

int _tmain(int argc, _TCHAR* argv[])
{
//    Event( "Security ",EVENTLOG_WARNING_TYPE);
//    Event( "Security ",EVENTLOG_INFORMATION_TYPE);
//    Event( "Security ",EVENTLOG_ERROR_TYPE);
    //Event( "Security ",0);
    //Event( "App",0);
    Event( "system",0);

    return 0;
}

BOOL Event(char *szLog,DWORD dwType)
{
    HANDLE hEvent;
    EVENTLOGRECORD             *pEventLogRecord;
    BYTE bBuffer[1024*32];
    DWORD dwRead;
    DWORD dwNeeded;
    DWORD dwThisRecord;
    DWORD dwTotal;
    PSID pSid;
    SID_NAME_USE            SNU;
    TCHAR szName[256];
    TCHAR szDomain[256];
    DWORD dwName;
    DWORD dwDomain;
    FILETIME FileTime;
    FILETIME LocalFileTime;
    SYSTEMTIME SysTime;
    __int64 lgTemp;
    __int64 SecsTo1970;

    dwName = 256;
    dwDomain = 256;
    SecsTo1970 = 116444736000000000;

    __try
    {
        hEvent = OpenEventLogA(NULL,szLog);
        if(hEvent == NULL)
        {
            printf( "OpenEventLog for %s Error: %d\n ",szLog,GetLastError());
            __leave;
        }

        printf( "\t\t=== Event Log ===\n\n ");
        printf( "%s:\n ",szLog);

        pEventLogRecord = (PEVENTLOGRECORD)bBuffer;
        GetOldestEventLogRecord(hEvent,&dwThisRecord);

        while(ReadEventLogA(hEvent,EVENTLOG_FORWARDS_READ | EVENTLOG_SEQUENTIAL_READ,
            0,pEventLogRecord,1024*32,&dwRead,&dwNeeded))
        {
            printf("%d %d\n",dwRead,dwNeeded);
            while(dwRead > 0)
            {
                //if(dwType == 0 || dwType == pEventLogRecord-> EventType)
                {
                    printf( "\nRecord Number:\t%d\t ",pEventLogRecord-> RecordNumber);

                    printf( "Type:\t ");
                    switch(pEventLogRecord-> EventType)
                    {
                    case EVENTLOG_ERROR_TYPE:
                        printf( "%s ", "Error\n ");
                        break;
                    case EVENTLOG_WARNING_TYPE:
                        printf( "%s ", "Warning\n ");
                        break;
                    case EVENTLOG_INFORMATION_TYPE:
                        printf( "%s ", "Information\n ");
                        break;
                    default:
                        printf( "\n ");
                        break;
                    }
                    printf( "Event ID:\t%d\t ",(short)pEventLogRecord-> EventID);
                    printf( "Source:\t%s\n ",(TCHAR*)pEventLogRecord+sizeof(EVENTLOGRECORD));

                    lgTemp = Int32x32To64(pEventLogRecord-> TimeGenerated,10000000) + SecsTo1970;
                    FileTime.dwLowDateTime = (DWORD) lgTemp;
                    FileTime.dwHighDateTime = (DWORD)(lgTemp>>32);
                    FileTimeToLocalFileTime(&FileTime, &LocalFileTime);
                    FileTimeToSystemTime(&LocalFileTime, &SysTime);
                    printf( "Time Generated: %02d-%02d-%02d %02d:%02d:%02d\n ",
                        SysTime.wMonth,SysTime.wDay,SysTime.wYear,
                        SysTime.wHour,SysTime.wMinute,SysTime.wSecond);

                    lgTemp = Int32x32To64(pEventLogRecord-> TimeWritten,10000000) + SecsTo1970;
                    FileTime.dwLowDateTime = (DWORD) lgTemp;
                    FileTime.dwHighDateTime = (DWORD)(lgTemp>>32);
                    FileTimeToLocalFileTime(&FileTime, &LocalFileTime);
                    FileTimeToSystemTime(&LocalFileTime, &SysTime);
                    printf( "Time Written: %02d-%02d-%02d %02d:%02d:%02d\n ",
                        SysTime.wMonth,SysTime.wDay,SysTime.wYear,
                        SysTime.wHour,SysTime.wMinute,SysTime.wSecond);

                    pSid = (PSID)((TCHAR*)pEventLogRecord + pEventLogRecord-> UserSidOffset);
                    if(LookupAccountSid(NULL,pSid,szName,&dwName,szDomain,&dwDomain,&SNU) != 0)
                    {
                        printf( "User: %s\n ",szName);
                    }
                    else
                    {
                        printf( "User: (None)\n ");
                    }
                    printf( "Description:\t%s\n ",(TCHAR*)pEventLogRecord + pEventLogRecord-> StringOffset);
                }
                dwRead -= pEventLogRecord-> Length;
                pEventLogRecord = (PEVENTLOGRECORD)((TCHAR*)pEventLogRecord + pEventLogRecord-> Length);
            }
            pEventLogRecord = (PEVENTLOGRECORD)bBuffer;
        }

        if(dwType == 0)
        {
            if(GetNumberOfEventLogRecords(hEvent,&dwTotal) == 0)
            {
                printf( "GetNumberOfEventLogRecords Error: %d\n ",GetLastError());
            }
            else
            {
                printf( "\nTotal %s : %d\n ",szLog,dwTotal);
            }
        }
    }
    __finally
    {
        if(hEvent != NULL)
        {
            CloseEventLog(hEvent);
        }
    }
    return TRUE;
}