怎样对Windows系统日志文件进行读写啊？

Question

怎样对Windows系统日志文件进行读写啊？请各位帮帮忙，发表一下见解

Answer 1

调用ReportEvent Api去写
日志读取可以参考以下链接所提及的内容
http://www.codeproject.com/system/sysevent.asp

Answer 2

ReadFile和WriteFile不明白你要干什么。如果为了取日志内容，直接用ReadEventLog函数就可以了；如果要修改日志文件内容的话，可就麻烦了，服务启动状态下单纯用WriteFile也写不了
呵呵，偶就在研究这些东东，头大着呢。。

Answer 3

http://www.vckbase.com/document/viewdoc.asp?id=428

Answer 4

BOOL Event(TCHAR*szLog,DWORD dwType)
{
HANDLE         hEvent;
EVENTLOGRECORD *pEventLogRecord;
BYTE           bBuffer[1024*32];
DWORD          dwRead;
DWORD          dwNeeded;
DWORD          dwThisRecord;
DWORD          dwTotal;
PSID           pSid;
SID_NAME_USE   SNU;
TCHAR          szName[256];
TCHAR          szDomain[256];
DWORD          dwName;
DWORD          dwDomain;
    FILETIME       FileTime;
FILETIME       LocalFileTime;
    SYSTEMTIME     SysTime;
    __int64        lgTemp;
    __int64        SecsTo1970; dwName     = 256;
dwDomain   = 256;
SecsTo1970 = 116444736000000000; __try
{
hEvent = OpenEventLog(NULL,szLog);
if(hEvent == NULL)
{
printf("OpenEventLog for %s Error: %d\n",szLog,GetLastError());
__leave;
} printf("\t\t=== Event Log ===\n\n");
printf("%s:\n",szLog); pEventLogRecord = (PEVENTLOGRECORD)bBuffer;
GetOldestEventLogRecord(hEvent,&dwThisRecord); while(ReadEventLog(hEvent,EVENTLOG_FORWARDS_READ | EVENTLOG_SEQUENTIAL_READ,
               0,pEventLogRecord,1024*32,&dwRead,&dwNeeded))
{
while(dwRead > 0)
{
if(dwType == 0 || dwType == pEventLogRecord->EventType)
{
printf("\nRecord Number:\t%d\t",pEventLogRecord->RecordNumber);

printf("Type:\t");
switch(pEventLogRecord->EventType)
{
case EVENTLOG_ERROR_TYPE:
printf("%s","Error\n");
break;
case EVENTLOG_WARNING_TYPE:
printf("%s","Warning\n");
break;
case EVENTLOG_INFORMATION_TYPE:
printf("%s","Information\n");
break;
default:
printf("\n");
break;
}
printf("Event ID:\t%d\t",(short)pEventLogRecord->EventID);
printf("Source:\t%s\n",(TCHAR*)pEventLogRecord+sizeof(EVENTLOGRECORD));

lgTemp = Int32x32To64(pEventLogRecord->TimeGenerated,10000000) + SecsTo1970;
     FileTime.dwLowDateTime = (DWORD) lgTemp;
        FileTime.dwHighDateTime = (DWORD)(lgTemp >> 32);
         FileTimeToLocalFileTime(&FileTime, &LocalFileTime);
           FileTimeToSystemTime(&LocalFileTime, &SysTime);
        printf("Time Generated: %02d-%02d-%02d   %02d:%02d:%02d\n",
               SysTime.wMonth,SysTime.wDay,SysTime.wYear,
              SysTime.wHour,SysTime.wMinute,SysTime.wSecond); lgTemp = Int32x32To64(pEventLogRecord->TimeWritten,10000000) + SecsTo1970;
     FileTime.dwLowDateTime = (DWORD) lgTemp;
        FileTime.dwHighDateTime = (DWORD)(lgTemp >> 32);
        FileTimeToLocalFileTime(&FileTime, &LocalFileTime);
            FileTimeToSystemTime(&LocalFileTime, &SysTime);
         printf("Time Written:   %02d-%02d-%02d   %02d:%02d:%02d\n",
               SysTime.wMonth,SysTime.wDay,SysTime.wYear,
             SysTime.wHour,SysTime.wMinute,SysTime.wSecond);                 pSid = (PSID)((TCHAR*)pEventLogRecord + pEventLogRecord->UserSidOffset);
if(LookupAccountSid(NULL,pSid,szName,&dwName,szDomain,&dwDomain,&SNU) != 0)
{
printf("User: %s\n",szName);
}
else
{
printf("User: (None)\n");
}
                 printf("Description:\t%s\n",(TCHAR*)pEventLogRecord + pEventLogRecord->StringOffset);
}
dwRead          -= pEventLogRecord->Length;
pEventLogRecord  = (PEVENTLOGRECORD)((TCHAR*)pEventLogRecord + pEventLogRecord->Length);
}
pEventLogRecord = (PEVENTLOGRECORD)bBuffer;
} if(dwType == 0)
{
if(GetNumberOfEventLogRecords(hEvent,&dwTotal) == 0)
{
       printf("GetNumberOfEventLogRecords Error: %d\n",GetLastError());
}
else
{
printf("\nTotal %s : %d\n",szLog,dwTotal);
}
}
}
__finally
{
if(hEvent != NULL)
{
CloseEventLog(hEvent);
}
}
return TRUE;
}
调用：
Event("Security",EVENTLOG_WARNING_TYPE);
Event("Security",EVENTLOG_INFORMATION_TYPE);
Event("Security",EVENTLOG_ERROR_TYPE);
Event("Security",0);
系统的和应用的类似！

Answer 5

有没有例子啊，主要是window 20000 系统日志的“描述“部分的中文不能读出来（英文部分可以的），事件查看器里能显示中文，不知大侠给个例子，多谢！

Answer 6

http://www.codeproject.com/system/sysevent.asp