高分求救,如何读取事件日志???

[jxvinus]

请问各位:
在WINDOWS2000,VC环境下
如何实现读取安全日志、应用日志、系统日志？？
谢谢！！！

[kaden]

void DisplayEntries( )
{
HANDLE h;
EVENTLOGRECORD *pevlr;
BYTE bBuffer[BUFFER_SIZE];
DWORD dwRead, dwNeeded, cRecords, dwThisRecord;

// Open the Application event log.

h = OpenEventLog( NULL, // use local computer
"Application"); // source name
if (h == NULL)
ErrorExit("Could not open the Application event log.");

pevlr = (EVENTLOGRECORD *) &bBuffer;

// Get the record number of the oldest event log record.

GetOldestEventLogRecord(h, &dwThisRecord);

// Opening the event log positions the file pointer for this
// handle at the beginning of the log. Read the event log records
// sequentially until the last record has been read.

while (ReadEventLog(h, // event log handle
EVENTLOG_FORWARDS_READ | // reads forward
EVENTLOG_SEQUENTIAL_READ, // sequential read
0, // ignored for sequential reads
pevlr, // pointer to buffer
BUFFER_SIZE, // size of buffer
&dwRead, // number of bytes read
&dwNeeded)) // bytes in next record
{
while (dwRead > 0)
{
// Print the record number, event identifier, type,
// and source name.

printf("%02d Event ID: 0x%08X ",
dwThisRecord++, pevlr->EventID);
printf("EventType: %d Source: %s\n",
pevlr->EventType, (LPSTR) ((LPBYTE) pevlr +
sizeof(EVENTLOGRECORD)));

dwRead -= pevlr->Length;
pevlr = (EVENTLOGRECORD *)
((LPBYTE) pevlr + pevlr->Length);
}

pevlr = (EVENTLOGRECORD *) &bBuffer;
}

CloseEventLog(h);
}

[haimingsun]

用BackupEventLog()将日志内容导出到一个文件eventlog.evt,
再在网上去下一个dumpel 将eventlog.evt转换为eventlog.txt文本文件。.

[beholder]

http://www.codeproject.com/system/sysevent.asp
去看看吧，有源代码的。

[beholder]

我现在也在编这方面的程序，前天才找到的。