读取系统日志eventlog记录

查看系统日志的执行程序：eventvwr.msc

方法一   用API读取

void DisplayEntries()
{
    char *tempBuf=new char[100];
    memset(tempBuf,0,100);
	HANDLE h;
    EVENTLOGRECORD *pevlr; 
    TCHAR bBuffer[4096] = {0}; 
 
    DWORD dwRead, dwNeeded, cRecords, dwThisRecord = 0; 
 
    // Open the Application event log. 

     /*Windows 日志：
     应用程序          对应于OpenEventLog（NULL,"Application"）
     安全              对应于OpenEventLog（NULL,"Security"）
     setup
     系统              对应于OpenEventLog（NULL,"System"）*/
 
    h = OpenEventLog( NULL,   /*use local computer*/  _T("System"));   // source name : System.
    if (h == NULL) 
    {    printf("Could not open the Application event log."); }
 
    pevlr = (EVENTLOGRECORD *) &bBuffer; 

    //GetOldestEventLogRecord(h, &dwThisRecord);