ReadEventLog

← →
Ura! (2001-12-21 17:48) [0]

Кто нибудь использовал ReadEventLog?
Поделитесь опытом или примерчиком.
Почему например не описана структура EVENTLOGRECORD
И константы типа: EVENTLOG_FORWARDS_READ
Какое это значение реально?

← →
IronWit (2002-02-14 12:41) [1]

константы то у меня есть. В msdn, а вот какую подключить библиотеку в которой определено EVENTLOGRECORD кто его знает, а может нужно самому описать, но там не все понятно. Если еще не разобрался присоединяйся.

← →
VuDZ (2002-02-14 13:04) [2]

Reading the Event Log
The following example reads all the records in the Application logfile and displays the event identifier, event type, and event source for each event log entry.
void DisplayEntries( ) { HANDLE h; EVENTLOGRECORD *pevlr; BYTE bBuffer[BUFFER_SIZE]; DWORD dwRead, dwNeeded, cRecords, dwThisRecord = 0; // Open the Application event log. h = OpenEventLog( NULL, // use local computer "Application"); // source name if (h == NULL) ErrorExit("Could not open the Application event log."); pevlr = (EVENTLOGRECORD *) &bBuffer; // Opening the event log positions the file pointer for this // handle at the beginning of the log. Read the records // sequentially until there are no more. while (ReadEventLog(h, // event log handle EVENTLOG_FORWARDS_READ | // reads forward EVENTLOG_SEQUENTIAL_READ, // sequential read 0, // ignored for sequential reads pevlr, // pointer to buffer BUFFER_SIZE, // size of buffer &dwRead, // number of bytes read &dwNeeded)) // bytes in next record { while (dwRead > 0) { // Print the event identifier, type, and source name. // The source name is just past the end of the // formal structure. printf("%02d Event ID: 0x%08X ", dwThisRecord++, pevlr->EventID); printf("EventType: %d Source: %s\n", pevlr->EventType, (LPSTR) ((LPBYTE) pevlr + sizeof(EVENTLOGRECORD))); dwRead -= pevlr->Length; pevlr = (EVENTLOGRECORD *) ((LPBYTE) pevlr + pevlr->Length); } pevlr = (EVENTLOGRECORD *) &bBuffer; } CloseEventLog(h); }

#define EVENTLOG_SEQUENTIAL_READ 0x0001
#define EVENTLOG_SEEK_READ 0x0002
#define EVENTLOG_FORWARDS_READ 0x0004
#define EVENTLOG_BACKWARDS_READ 0x0008

← →
VuDZ (2002-02-14 13:05) [3]

EVENTLOGRECORD
The EVENTLOGRECORD structure contains information about an event record returned by the ReadEventLog function.

typedef struct _EVENTLOGRECORD {
DWORD Length;
DWORD Reserved;
DWORD RecordNumber;
DWORD TimeGenerated;
DWORD TimeWritten;
DWORD EventID;
WORD EventType;
WORD NumStrings;
WORD EventCategory;
WORD ReservedFlags;
DWORD ClosingRecordNumber;
DWORD StringOffset;
DWORD UserSidLength;
DWORD UserSidOffset;
DWORD DataLength;
DWORD DataOffset;
//
// Then follow:
//
// TCHAR SourceName[]
// TCHAR Computername[]
// SID UserSid
// TCHAR Strings[]
// BYTE Data[]
// CHAR Pad[]
// DWORD Length;
//
} EVENTLOGRECORD, *PEVENTLOGRECORD;
Members
Length
Specifies the length, in bytes, of this event record. Note that this value is stored at both ends of the entry to ease moving forward or backward through the log. The length includes any pad bytes inserted at the end of the record for DWORD alignment.
Reserved
Reserved.
RecordNumber
Contains a record number that can be used with the EVENTLOG_SEEK_READ flag passed in a call to the ReadEventLog function to begin reading at a specified record.
TimeGenerated
The time at which this entry was submitted. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.
TimeWritten
Specifies the time at which this entry was received by the service to be written to the logfile. This time is measured in the number of seconds elapsed since 00:00:00 January 1, 1970, Universal Coordinated Time.
EventID
Specifies the event. This is specific to the source that generated the event log entry, and is used, together with SourceName, to identify a message in a message file that is presented to the user while viewing the log.
EventType
Specifies the type of event. This member can be one of the following values. Value Meaning
EVENTLOG_ERROR_TYPE Error event
EVENTLOG_WARNING_TYPE Warning event
EVENTLOG_INFORMATION_TYPE Information event
EVENTLOG_AUDIT_SUCCESS Success Audit event
EVENTLOG_AUDIT_FAILURE Failure Audit event

← →
VuDZ (2002-02-14 13:05) [4]

For more information, see Event Types.

NumStrings
Specifies the number of strings present in the log (at the position indicated by StringOffset). These strings are merged into the message before it is displayed to the user.
EventCategory
Specifies a subcategory for this event. This subcategory is source specific.
ReservedFlags
Reserved.
ClosingRecordNumber
Reserved.
StringOffset
Specifies the offset of the strings within this event log entry.
UserSidLength
Specifies the length, in bytes, of the UserSid member. This value can be zero if no security identifier was provided.
UserSidOffset
Specifies the offset of the security identifier (SID) within this event record. To obtain the user name for this SID, use the LookupAccountSid function.
DataLength
Specifies the length, in bytes, of the event-specific data (at the position indicated by DataOffset).
DataOffset
Specifies the offset of the event-specific information within this event record. This information could be something specific (a disk driver might log the number of retries, for example), followed by binary information specific to the event being logged and to the source that generated the entry.
SourceName
Contains the variable-length null-terminated string specifying the name of the source (application, service, driver, subsystem) that generated the entry. This is the name used to retrieve from the registry the name of the file containing the message strings for this source. It is used, together with the event identifier, to get the message string that describes this event.
Computername
Contains the variable-length null-terminated string specifying the name of the computer that generated this event. There may also be some pad bytes after this field to ensure that the UserSid is aligned on a DWORD boundary.
UserSid
Specifies the security identifier of the active user at the time this event was logged. This member may be empty if the UserSidLength member is zero.
Remarks
The defined members are followed by the replacement strings for the message identified by the event identifier, the binary information, some pad bytes to make sure the full entry is on a DWORD boundary, and finally the length of the log entry again. Because the strings and the binary information can be of any length, no structure members are defined to reference them.

The event identifier together with SourceName and a language identifier identify a message string that describes the event in more detail. The strings are used as replacement strings and are merged into the message string to make a complete message. The message strings are contained in a message file specified in the source entry in the registry. To obtain the appropriate message string from the message file, load the message file with the LoadLibrary function and use the FormatMessage function.

The binary information is information that is specific to the event. It could be the contents of the processor registers when a device driver got an error, a dump of an invalid packet that was received from the network, a dump of all the structures in a program (when the data area was detected to be corrupt), and so on. This information should be useful to the writer of the device driver or the application in tracking down bugs or unauthorized breaks into the application.

← →
IronWit (2002-02-14 14:16) [5]

Спасибо, но все это есть и у меня, а как это дело прикрутить под delphi ума не приложу. Я просто чайник еще в вопросах программирования на дельфи без применения визуальных компонентов. Поэтому как то еще не все понятно. То есть как перевести (прописать) EVENTLOGRECORD на дельфи, а точнее, как это применять в своей программе.
Хотя бы примерное направление движения укажите плс.

← →
IronWit (2002-02-15 11:56) [6]

все, ответ готов, комментарии в мыло,если что.

program Project1;
{$APPTYPE CONSOLE}
uses
SysUtils,windows;
type
{Event log entry copied from the Win32 SDK.}
TEventLog = record
Length:dword;
Reserved: DWord;
RecordNumber: DWord;
TimeGenerated: DWord;
TimeWritten: DWord;
EventID: Integer;
EventType: Word;
NumStrings: Word;
EventCategory: Word;
ReservedFlags: Word;
ClosingRecordNumber: DWord;
StringOffset: DWord;
UserSIDLength: DWord;
UserSIDOffset: DWord;
DataLength: DWord;
DataOffset: DWord;
DATA: array[0..1024] of char;
end;

const

EVENTLOG_SEQUENTIAL_READ = $0001;
EVENTLOG_SEEK_READ = $0002;
EVENTLOG_FORWARDS_READ = $0004;
EVENTLOG_BACKWARDS_READ = $0008;
var
EvLogHandle: tHandle;
Eventm:PChar;
dw1,dw2,dw:dword;
buffer:TEventLog;
Begin
Eventm:="Security";
// Получаем дескриптор журнала приложений на компьютере Server
// Так-же можно открыть журнал системы (Eventm="System") и
// журнал безопастности (Eventm="Security")
//Eventm:="Application";
EvLogHandle := OpenEventLog ("pteh_bd", Eventm);
GetNumberOfEventLogRecords(EvLogHandle,dw);
readeventlog(evloghandle,EVENTLOG_SEQUENTIAL_READ or EVENTLOG_BACKWARDS_READ,dw,@buffer,sizeof(buffer),dw1,dw2);
closeeventlog(EvLogHandle);
end.

ReadEventLog Найти похожие ветки