zoukankan      html  css  js  c++  java
  • Windows Event Log相关函数使用(1)

    一.EvtOpenLog

    The EvtOpenLog function opens an exported or live event log and returns a handle that can be used to access the log. The returned handle can be used by subsequent calls to the EvtGetLogInfo function.

    示例:

    EVT_HANDLE log = NULL;      
    LPCWSTR logPath = L"SimpleOperationalChannel";
    
    log = EvtOpenLog( NULL, logPath, EvtOpenChannelPath);
    
    if(log == NULL)
    {
        wprintf(L"Error opening the log: 0x%x \n", GetLastError());
        return 1;
    }
    

    二.EvtClose

    The EvtClose function closes an open event object handle that was previously returned from a Windows Event Log function. Any handle that is returned by a Windows Event Log function must be closed using this function call when the user is finished with the handle. The handle that is passed into this function becomes invalid after this function is successfully called.

    EVT_HANDLE log = NULL;      
    LPCWSTR logPath = L"SimpleOperationalChannel";
    
    log = EvtOpenLog( NULL, logPath, EvtOpenChannelPath);
    ...
    EvtClose(log);
    

    三.EvtGetLogInfo

    The EvtGetEventInfo function allows the caller to determine which clause in an event query or subscription filter selected a given event or to determine the channel or log that the event came from.

    可查询的字段

    typedef enum _EVT_LOG_PROPERTY_ID
    {
        EvtLogCreationTime = 0,             // EvtVarTypeFileTime
        EvtLogLastAccessTime,               // EvtVarTypeFileTime
        EvtLogLastWriteTime,                // EvtVarTypeFileTime
        EvtLogFileSize,                     // EvtVarTypeUInt64
        EvtLogAttributes,                   // EvtVarTypeUInt32
        EvtLogNumberOfLogRecords,           // EvtVarTypeUInt64
        EvtLogOldestRecordNumber,           // EvtVarTypeUInt64
        EvtLogFull,                         // EvtVarTypeBoolean
    
    } EVT_LOG_PROPERTY_ID;
    

    示例:

    EVT_VARIANT* logProperty = (EVT_VARIANT*) malloc (sizeof (EVT_VARIANT));
    DWORD bufferSize = sizeof(EVT_VARIANT);
    
    if( !EvtGetLogInfo(log, EvtLogNumberOfLogRecords, bufferSize, logProperty, &bufferSize))
    {   
        //...
    }
    
    if(logProperty->Type == EvtVarTypeNull)
    {
        wprintf(L"The value of the log number of events property is NULL.\n");
    }
    else
    {
        wprintf(L"The value of the log number of events property is: %I64u \n", 
            logProperty->UInt64Val);
    }
    

    四.日志操作维护

    1.EvtClearLog

    The EvtClearLog function clears all events from an active log and exports the events to a target log file.

    示例:

    if ( !EvtClearLog(NULL, 
        L"Application",
        L"c:\\temp\\MyClearedEvents.log", 
        0 ))
        return GetLastError();
    

    注意点:目录必须存在

    2.EvtExportLog

    The EvtExportLog function exports selected events from a channel or from a log file to a target log file based on an event query.

    if ( !EvtExportLog(NULL, 
        L"Application",
        L"*",
        L"c:\\MyExportedEvents.log", 
        EvtExportLogChannelPath ))
        return GetLastError();
    

    3.EvtArchiveExportedLog

    The EvtArchiveExportedLog function archives localized information associated with the events in specified logs that have been created by either the EvtClearLog function or the EvtExportLog function.

    示例:

    if ( !EvtArchiveExportedLog(NULL, 
        L"c:\\MyExportedEvents.log", 
        MAKELCID( MAKELANGID(LANG_ENGLISH, SUBLANG_ENGLISH_US), SORT_DEFAULT ),
        0 ))
        return GetLastError();
    

    存档的日志在此目录下:C:\Windows\System32\winevt\Logs

  • 相关阅读:
    WMS学习笔记:1.尝试加载WMS
    ftp文件上传和下载
    [WorldWind学习]19.WebDownload
    ASP.NET C# 如何在程序中控制IIS服务或应用程序池重启?
    asp.net mvc 全局权限过滤器及继成权限方法
    使用ActionFilterAttribute 记录 WebApi Action 请求和返回结果记录
    单点登录系统功能调试界面
    asp.net 读取RedisSessionStateProvider配置
    Redis-benchmark测试Redis性能
    ASP.NET MVC中移除冗余Response Header
  • 原文地址:https://www.cnblogs.com/Clingingboy/p/2938628.html
Copyright © 2011-2022 走看看