如何用delphi读出系统日志啊

unit NtEvent;
{* |<PRE>
实现Windows NT/2K/XP系统日志类型的管理。
| 
通常情况下系统中只包含三种类型的日志文件：应用程序（Application）日志，安全
（Security）日志和系统（System）日志。本单元提供的日志类型管理类可以在系统中添
加其它类型的日志系统。
| 
Author: Licwing Zue
This software is free
| 修订：
1. 2002/11/29 建立日志类型管理单元|</PRE>}interfaceuses Windows, SysUtils, Classes, Registry;type
 TEventLog = class(TObject)
 {* 日志类型对象，负责日志类型的信息读写}
 private
 FDisplayNameFile: string;
 FDisplayNameID: Cardinal;
 FLogFile: string;
 FMaxsize: Cardinal;
 FName: string;
 FPrimaryModule: string;
 FRetention: Cardinal;
 procedure SetDisplayNameFile(Value: string);
 procedure SetName(Value: string);
 public
 constructor Create(const hName: string);
 {* 日志类型对象构造器，用于产生一个该类的实例
 | hName: 日志类型名称}
 destructor Destory;
 procedure LoadFromRegistry;
 {* 读取日志类型信息}
 procedure SaveToRegistry;
 {* 保存日志类型信息}
 property DisplayNameFile: string read FDisplayNameFile write SetDisplayNameFile;
 {* 存储日志类型显示名称的文件名称}
 property DisplayNameID: Cardinal read FDisplayNameID write FDisplayNameID;
 {* 日志类型显示名称在存储文件中的资源序号}
 property LogFile: string read FLogFile write FLogFile;
 {* 日志文件名，包含路径。可以使用系统环境变量:%SystemRoot%等}
 property Maxsize: Cardinal read FMaxsize write FMaxsize;
 {* 日志文件最大尺寸}
 property Name: string read FName write SetName;
 {* 日志类型名称}
 property PrimaryModule: string read FPrimaryModule;
 {* 日志类型控制模块，同日志类型名称}
 property Retention: Cardinal read FRetention write FRetention;
 {* 日志保存时间}
 end; TEventLogManager = class (TObject)
 {* 日志类型管理对象，负责对日志类型的添加、删除和检索等}
 private
 fEventLogList: TStrings;
 fReg: TRegistry;
 function DeleteFromRegistry(hEventLogName: string): Boolean;
 function GetCount: Integer;
 function GetItems(Index: Integer): TEventLog; public
 constructor Create(const AutoRefresh: boolean=true);
 {* 日志类型对象构造器，用于产生一个该类的实例
 | AutoRefresh: 自动更新开关，默认打开}
 destructor Destory;
 function Add(hEventLogName: string): TEventLog;
 {* 添加日志类型，返回添加的日志对象
 | hEventLogName: 日志类型名称}
 procedure Clear;
 {* 清除读取的日志类型纪录，但不清除保存的日志类型纪录}
 function Delete(const hEventLogName: string): Boolean;
 {* 删除指定的日志类型
 | hEventLogName: 日志类型名称}
 procedure Refresh;
 {* 更新日志类型}
 property Count: Integer read GetCount;
 {* 日志类型数量}
 property Items[Index: Integer]: TEventLog read GetItems;
 {* 日志类型队列}
 end;
 implementation
const
 EVENT_SAVE_PATH = '\SYSTEM\CurrentControlSet\Services\Eventlog\';
 { 日志类型保存位置} Event_File = 'File';
 { 日志文件保存的绝对位置，通常是在系统目录中。
 如：C:\Winnt\System32\Config\Sample.EVT }
 Event_MaxSize = 'MaxSize';
 { 日志文件最大尺寸，默认512K}
 Event_PrimaryModule = 'PrimaryModule'; Event_Sources = 'Sources';
 Event_Retention = 'Retention';
 Event_DisplayNameFile = 'DisplayNameFile';
 Event_DisplayNameID = 'DisplayNameID';
{
********************************** TEventLog ***********************************
}
constructor TEventLog.Create(const hName: string);
begin
 SetName(hName); FMaxsize := $80000; // 512K
 FRetention := $93A80; FDisplayNameFile := '';
 FDisplayNameID := 0; FLogFile := '%SystemRoot%\System32\config\'+hName+'.EVT';
end;destructor TEventLog.Destory;
beginend;procedure TEventLog.LoadFromRegistry;
var
 fReg: TRegistry;
begin
 fReg := TRegistry.Create;
 try
 fReg.RootKey := HKEY_LOCAL_MACHINE;
 if fReg.OpenKey(EVENT_SAVE_PATH+fName,false) then
 begin
 if fReg.KeyExists(Event_DisplayNameID) then
 fDisplayNameID := fReg.ReadInteger(Event_DisplayNameID); if fReg.KeyExists(Event_DisplayNameFile) then
 fDisplayNameFile := fReg.ReadString(Event_DisplayNameFile); if fReg.KeyExists(Event_MaxSize) then
 fMaxsize := fReg.ReadInteger(Event_MaxSize); if fReg.KeyExists(Event_Retention) then
 fRetention := fReg.ReadInteger(Event_Retention); if fReg.KeyExists(Event_File) then
 fLogFile := fReg.ReadString(Event_File);
 end;
 finally
 fReg.CloseKey;
 fReg.Free;
 end;
end;procedure TEventLog.SaveToRegistry;
var
 fReg: TRegistry;
begin
 fReg := TRegistry.Create;
 try
 fReg.RootKey := HKEY_LOCAL_MACHINE;
 fReg.OpenKey(EVENT_SAVE_PATH+fName,True); if (fDisplayNameID > 0) and (fDisplayNameFile <> '') then
 begin
 fReg.WriteInteger(Event_DisplayNameID,fDisplayNameID);
 fReg.WriteExpandString(Event_DisplayNameFile,fDisplayNameFile);
 end; fReg.WriteInteger(Event_MaxSize,fMaxsize);
 fReg.WriteInteger(Event_Retention,fRetention);
 fReg.WriteString(Event_PrimaryModule,fPrimaryModule);
 fReg.WriteExpandString(Event_File,fLogFile);
 finally
 fReg.CloseKey;
 fReg.Free;
 end;
end;procedure TEventLog.SetDisplayNameFile(Value: string);
begin
 FDisplayNameFile := Value;
end;procedure TEventLog.SetName(Value: string);
begin
 fName := Value;
 fPrimaryModule := Value;
end;{
******************************* TEventLogManager *******************************
}
constructor TEventLogManager.Create(const AutoRefresh: boolean=true);
begin
 fReg := TRegistry.Create;
 fReg.RootKey := HKEY_LOCAL_MACHINE;

 fEventLogList := TStringList.Create;
 if AutoRefresh then Refresh;
end;destructor TEventLogManager.Destory;
begin
 fReg.Free;
 fEventLogList.Free;
 inherited;
end;function TEventLogManager.Add(hEventLogName: string): TEventLog;
var
 aEventLog: TEventLog;
begin
 aEventLog := TEventLog.Create(hEventLogName);
 fEventLogList.AddObject(hEventLogName,aEventLog);
 Result := aEventLog;
end;procedure TEventLogManager.Clear;
var
 Idx: Integer;
begin
 for Idx:=0 to fEventLogList.Count-1 do
 TEventLog(fEventLogList.Objects[Idx]).Free;

 fEventLogList.Clear;
end;function TEventLogManager.Delete(const hEventLogName: string): Boolean;
var
 Idx: Integer;
begin
 Result := false;
 for Idx := fEventLogList.Count-1 downto 0 do
 begin
 if UpperCase(hEventLogName) = UpperCase(TEventLog(fEventLogList.Objects[Idx]).Name) then
 begin
 Result := DeleteFromRegistry(hEventLogName);
 break;
 end;
 end;
end;function TEventLogManager.DeleteFromRegistry(hEventLogName: string): Boolean;
begin
 Result := fReg.DeleteKey(EVENT_SAVE_PATH+hEventLogName)
end;function TEventLogManager.GetCount: Integer;
begin
 Result := fEventLogList.Count;
end;function TEventLogManager.GetItems(Index: Integer): TEventLog;
begin
 Result := TEventLog(fEventLogList.Objects[Index]);
end;procedure TEventLogManager.Refresh;
var
 buf: TStrings;
 fEventLog: TEventLog;
 Idx: Integer;
begin
 Clear; if fReg.OpenKey(EVENT_SAVE_PATH, false) then
 begin
 buf := TStringList.Create;
 try
 fReg.GetKeyNames(buf); // 指派信息到类列表
 for Idx:=0 to buf.Count-1 do
 begin
 fEventLog := Add(Buf[Idx]);
 fEventLog.LoadFromRegistry;
 end;
 finally
 buf.Free;
 fReg.CloseKey;
 end;
 end;
end;end.
查下列函数
backupeventlog,
cleareventlog,
getoldeventlogrecord,
getnumberofeventlogrecords,
readeventlog,
reportevent,
openeventlog....
http://www.vckbase.com/document/viewdoc/?id=428看VC的

调试易

如何用delphi读出系统日志啊

解决方案 »