在c++中获取事件日志

Question

我试图使用下面的代码在c++中获取系统事件日志，对于我获得的某些条件，查询事件信息.But，事件ID的无效事件ID.Value是错误的。

我的代码如下所示，

EVENTLOG_FULL_INFORMATION evntLogInfo;
DWORD dwByteRequd,cbSize=0,dwBytesToRead=MAX_RECORD_BUFFER_SIZE,dwBytesRead,dwMinimumBytesNeeded,numRecord;
PBYTE pBuffer,currentData,endRecord;
HANDLE eventHandle=OpenEventLog(NULL,"Application");
if(eventHandle==INVALID_HANDLE_VALUE)
    cout<<"\nError "<<GetLastError();
else
{
    pBuffer=(PBYTE)malloc(MAX_RECORD_BUFFER_SIZE);
    if(pBuffer==NULL)
    {
        cout<<"\nNot enough memory";
        CloseEventLog(eventHandle);
    }
    else
    {
        //GetEventLogInformation(eventHandle,EVENTLOG_FULL_INFO,&pBuffer,cbSize,&dwByteRequd);
        ReadEventLog(eventHandle,EVENTLOG_SEQUENTIAL_READ|EVENTLOG_FORWARDS_READ,0,pBuffer,dwBytesToRead,&dwBytesRead,&dwMinimumBytesNeeded);

        if(GetLastError()==ERROR_INSUFFICIENT_BUFFER )
        {
            pBuffer=(PBYTE)realloc(pBuffer,dwMinimumBytesNeeded);
            if(pBuffer==NULL)
            {
                    cout<<GetLastError();
                CloseEventLog(eventHandle);
            }
            else
            {
                     dwBytesToRead=dwMinimumBytesNeeded;
                     ReadEventLog(eventHandle,EVENTLOG_SEQUENTIAL_READ|EVENTLOG_FORWARDS_READ,0,pBuffer,dwBytesToRead,&dwBytesRead,&dwMinimumBytesNeeded);
            }
          }
        GetNumberOfEventLogRecords(eventHandle,&numRecord);
        cout<<numRecord<<"\n";
        endRecord=pBuffer+dwBytesToRead;
        while(pBuffer<endRecord)
        {

            currentData=pBuffer;    
            PEVENTLOGRECORD TempVar = (PEVENTLOGRECORD)currentData;
            cout<<((PEVENTLOGRECORD)currentData)->EventID<<"\t";

            cout<<((PEVENTLOGRECORD)currentData)->EventType<<"\t";
            cout<<((PEVENTLOGRECORD)currentData)->Length<<"\n";
            //  DWOR error=GetLastError();

        }
    }
}

谢谢。

Answer 1

长话短说，但是如果您想看到事件视图显示的相同的事件ids (eventvwr.msc)，只需从EventID中打印前两个字节即可。例如，来自1073742727的前2个字节是903。

长话短说:现在EventID存储所谓的事件实例id，您可以从MSDN获得更多信息。