如何读取Windows系统事件日志(获得上次关机时间、本次开机时间等)
根据开机事件的EventID为6005,关机事件的EventID为6006;来读出相应的时间。
(1) 读取事件日志
#include <string>
#include <stdio.h>
#include <time.h>
#include <windows.h>
using namespace std;
int ReadSystemEventLog(const char *Src, string &Result, FILE * pFile)
{
DWORD read_len, next_len;
char Buffer[256], Data[4096], *pchar;
HANDLE Handle = OpenEventLog(NULL, Src);
if (Handle==NULL)
{
CloseHandle(Handle);
return -1;
}
while(ReadEventLog(Handle, EVENTLOG_FORWARDS_READ | EVENTLOG_SEQUENTIAL_READ,1, (EVENTLOGRECORD*)Data, sizeof(Data), &read_len, &next_len))
{
for(short i=0; i<read_len;)
{
printf("%d/n",read_len);
EVENTLOGRECORD *ptr = (EVENTLOGRECORD*)(Data+i);
switch(ptr->EventType) //事件类型
{
case EVENTLOG_SUCCESS:
pchar= "成功";
break;
case EVENTLOG_ERROR_TYPE:
pchar= "错误";
break;