Question

我试图通过使用以下代码在c ++中获取系统事件日志， Querying for Event Information。但是对于我得到的某些情况，无效的事件ID。事件ID的值是 1073742727 。这是错误的。

我的代码如下所示，

EVENTLOG_FULL_INFORMATION evntLogInfo;
DWORD dwByteRequd,cbSize=0,dwBytesToRead=MAX_RECORD_BUFFER_SIZE,dwBytesRead,dwMinimumBytesNeeded,numRecord;
PBYTE pBuffer,currentData,endRecord;
HANDLE eventHandle=OpenEventLog(NULL,"Application");
if(eventHandle==INVALID_HANDLE_VALUE)
    cout<<"\nError "<<GetLastError();
else
{
    pBuffer=(PBYTE)malloc(MAX_RECORD_BUFFER_SIZE);
    if(pBuffer==NULL)
    {
        cout<<"\nNot enough memory";
        CloseEventLog(eventHandle);
    }
    else
    {
        //GetEventLogInformation(eventHandle,EVENTLOG_FULL_INFO,&pBuffer,cbSize,&dwByteRequd);
        ReadEventLog(eventHandle,EVENTLOG_SEQUENTIAL_READ|EVENTLOG_FORWARDS_READ,0,pBuffer,dwBytesToRead,&dwBytesRead,&dwMinimumBytesNeeded);

        if(GetLastError()==ERROR_INSUFFICIENT_BUFFER )
        {
            pBuffer=(PBYTE)realloc(pBuffer,dwMinimumBytesNeeded);
            if(pBuffer==NULL)
            {
                    cout<<GetLastError();
                CloseEventLog(eventHandle);
            }
            else
            {
                     dwBytesToRead=dwMinimumBytesNeeded;
                     ReadEventLog(eventHandle,EVENTLOG_SEQUENTIAL_READ|EVENTLOG_FORWARDS_READ,0,pBuffer,dwBytesToRead,&dwBytesRead,&dwMinimumBytesNeeded);
            }
          }
        GetNumberOfEventLogRecords(eventHandle,&numRecord);
        cout<<numRecord<<"\n";
        endRecord=pBuffer+dwBytesToRead;
        while(pBuffer<endRecord)
        {

            currentData=pBuffer;    
            PEVENTLOGRECORD TempVar = (PEVENTLOGRECORD)currentData;
            cout<<((PEVENTLOGRECORD)currentData)->EventID<<"\t";

            cout<<((PEVENTLOGRECORD)currentData)->EventType<<"\t";
            cout<<((PEVENTLOGRECORD)currentData)->Length<<"\n";
            //  DWOR error=GetLastError();

        }
    }
}

感谢。

Answer 1

长话短说，但是如果你想看到相同的事件ID，事件查看器显示你（eventvwr.msc）只是从你的EventID打印前2个字节。例如，1073742727中的前2个字节是903。

长篇故事：现在EventID存储了所谓的事件实例ID，你可以从MSDN获得更多信息。

在c ++中获取事件日志

1 个答案: