读取系统日志eventlog记录

查看系统日志的执行程序：eventvwr.msc

方法一   用API读取

void DisplayEntries()
{
    char *tempBuf=new char[100];
    memset(tempBuf,0,100);
	HANDLE h;
    EVENTLOGRECORD *pevlr; 
    TCHAR bBuffer[4096] = {0}; 
 
    DWORD dwRead, dwNeeded, cRecords, dwThisRecord = 0; 
 
    // Open the Application event log. 

     /*Windows 日志：
     应用程序          对应于OpenEventLog（NULL,"Application"）
     安全              对应于OpenEventLog（NULL,"Security"）
     setup
     系统              对应于OpenEventLog（NULL,"System"）*/
 
    h = OpenEventLog( NULL,   /*use local computer*/  _T("System"));   // source name : System.
    if (h == NULL) 
    {    printf("Could not open the Application event log."); }
 
    pevlr = (EVENTLOGRECORD *) &bBuffer; 

    //GetOldestEventLogRecord(h, &dwThisRecord);
    // Opening the event log positions the file pointer for this 
    // handle at the beginning of the log. Read the records 
    // sequentially until there are no more. 
 
    while (ReadEventLog(h,                // event log handle 
             EVENTLOG_FORWARDS_READ |  // reads forward 
             EVENTLOG_SEQUENTIAL_READ, // sequential read 
             0,            // ignored for sequential reads 
             pevlr,        // pointer to buffer 
             4096,  // size of buffer 
             &dwRead,      // number of bytes read 
             &dwNeeded))   // bytes in next record 
    {
        while (dwRead > 0) 
        { 
            // Print the event identifier, type, and source name. 
            // The source name is just past the end of the formal structure. 
             
            //_tprintf(_T("%02d  Event ID: 0x%08X "),   dwThisRecord++, pevlr->EventID); 
	    _tprintf(_T("%02d  Event ID: %08d "),   dwThisRecord++, pevlr->EventID); 
            _tprintf(_T("EventType: %d Source: %s\n"),  pevlr->EventType, (LPCTSTR)((LPBYTE) pevlr + sizeof(EVENTLOGRECORD))); 
			
            dwRead -= pevlr->Length; 
            pevlr = (EVENTLOGRECORD *) ((LPBYTE) pevlr + pevlr->Length); 
        } 
 
        pevlr = (EVENTLOGRECORD *) &bBuffer; 
    } 
 
    CloseEventLog(h); 
}

这个方法读出来的记录有个问题，source是eventlog的记录，eventID的值都不对。比如6005，是2147477642.。而其它来源的记录不会有问题

方法二  .net 提供的类EventLog

msdn上 eventlog类的介绍：

https://msdn.microsoft.com/zh-cn/library/system.diagnostics.eventlog(v=vs.110).aspx

double DiffSec=0;

            EventLog e = new EventLog();
            e.Log = "System";
            foreach (EventLogEntry l in e.Entries)
            {
                    if (l.EventID == 6006) // shutdown
                    { 
                         Console.WriteLine( "关机时间："+ l.TimeGenerated );
                         year = l.TimeGenerated.Year;
                         month = l.TimeGenerated.Month;
                         day = l.TimeGenerated.Day;
                         hour = l.TimeGenerated.Hour;
                         min = l.TimeGenerated.Minute;
                         sec = l.TimeGenerated.Second;
                    }
               
                    if (l.EventID == 6005) // shutup
                    {
                         Console.WriteLine("开机时间：" + l.TimeGenerated);
                         year2= l.TimeGenerated.Year;
                         month2 = l.TimeGenerated.Month;
                         day2 = l.TimeGenerated.Day;
                         hour2 = l.TimeGenerated.Hour;
                         min2 = l.TimeGenerated.Minute;
                         sec2 = l.TimeGenerated.Second;
                    }
                     

            }
            if ((year == 0) | (year2 == 0))
            {
                Console.WriteLine("error");
                return 1;
            }
            else 
            {
                System.DateTime ShutdownTime = new DateTime(year, month, day, hour, min, sec);
                System.DateTime ShutupTime = new DateTime(year2, month2, day2, hour2, min2, sec2);
                System.TimeSpan diff2 = ShutupTime - ShutdownTime;
                DiffSec = diff2.TotalSeconds;
                if (DiffSec >= int.Parse(args[0])) 
                {
                    Console.WriteLine("0");
                    return 0;
                }
                else
                {
                    Console.WriteLine("1");
                    return 1;
                }
            }