如何读取Windows系统事件日志（获得上次关机时间、本次开机时间等）

如何读取Windows系统事件日志（获得上次关机时间、本次开机时间等）

根据开机事件的EventID为6005，关机事件的EventID为6006；来读出相应的时间。

(1) 读取事件日志

#include <string>

#include <stdio.h>

#include <time.h>

#include <windows.h>

using namespace std;

int ReadSystemEventLog(const char *Src, string &Result, FILE * pFile) 

{

       DWORD read_len, next_len; 

       char Buffer[256], Data[4096], *pchar; 

       HANDLE Handle = OpenEventLog(NULL, Src);

       if (Handle==NULL)

       {

              CloseHandle(Handle);

              return -1;

       }

       while(ReadEventLog(Handle, EVENTLOG_FORWARDS_READ | EVENTLOG_SEQUENTIAL_READ,1, (EVENTLOGRECORD*)Data, sizeof(Data), &read_len, &next_len))

       {

              for(short i=0; i<read_len;) 

              {

                     printf("%d/n",read_len);

                     EVENTLOGRECORD *ptr = (EVENTLOGRECORD*)(Data+i);

                     switch(ptr->EventType) //事件类型  

                     {

                     case EVENTLOG_SUCCESS:

                            pchar= "成功";  

                            break; 

            case EVENTLOG_ERROR_TYPE:

                            pchar= "错误";

                            break;