python读取windows日志_甚至读取特定的Windows事件日志

不！没有任何函数允许您根据事件id获取事件GetNumberOfEventLogRecords Retrieves the number of records in the specified event log.

GetOldestEventLogRecord Retrieves the absolute record number of the oldest record

in the specified event log.

NotifyChangeEventLog Enables an application to receive notification when an event

is written to the specified event log.

ReadEventLog Reads a whole number of entries from the specified event log.

RegisterEventSource Retrieves a registered handle to the specified event log.

唯一感兴趣的方法是读取最早的事件。

您必须以任何方式迭代结果，并且您的方法是正确的：)

您只能像下面这样更改方法的形式，但这是不必要的。events = win32evtlog.ReadEventLog(hand, flags,0)

events_list = [event for event in events if event.EventID == "27035"]

if event_list:

print 'Event Category:', events_list[0].EventCategory

这和你做的一样，但更简洁