获得计算机事件信息代码,CSharp代码库,德仔网

代码语言

代码分类

【CSharp】获得计算机事件信息

作者:o330820350 / 发布于2013/10/24/ 549

获得计算机的开关机事件信息


	//获得事件类型
	void GetInicdentType(int Entype,char *pdata)
	{
	switch(Entype)
	{
	case EVENTLOG_ERROR_TYPE:
	 swprintf(pdata,L"错误");
	 break;
	case EVENTLOG_WARNING_TYPE:
	 swprintf(pdata, L"警告");
	 break;
	case EVENTLOG_INFORMATION_TYPE:
	 swprintf(pdata, L"信息");
	 break;
	case EVENTLOG_AUDIT_SUCCESS:
	 swprintf(pdata, L"审计成功");
	 break;
	case EVENTLOG_AUDIT_FAILURE:
	 swprintf(pdata, L"审计失败");
	 break;
	default:
	 swprintf(pdata, L"未知");
	 break;
	}
	}

	
	//事件检查，并输出到xml文件
	BOOL CompEventDentCheck()
	{
	HANDLE hand;
	EVENTLOGRECORD *pevlr;
	DWORD dwRead, dwNeeded, dwThisRecord;
	BYTE bBuffer[BUFFER_SIZE];
	char Buffer[256];
	char *pBuff;
	TCHAR *pchwBuff;
	hand = OpenEventLog( NULL, // use local computer
	 L"System"); // source name
	if (hand == NULL)
	{
	 printf("打开事件失败\n");
	 return 0;
	}
	pevlr = (EVENTLOGRECORD *) &bBuffer;

	GetOldestEventLogRecord(hand, &dwThisRecord);
	while (ReadEventLogA(hand, // event log handle
	 EVENTLOG_FORWARDS_READ | // reads forward
	 EVENTLOG_SEQUENTIAL_READ, // sequential read
	 0, // ignored for sequential reads
	 pevlr, // pointer to buffer
	 BUFFER_SIZE, // size of buffer
	 &dwRead, // number of bytes read
	 &dwNeeded)) // bytes in next record
	{
	 while (dwRead > 0)
	 {
	 if ((short)pevlr->EventID == 6005 || (short)pevlr->EventID == 6006)
	 {
	 //获得事件ID
	 DWORD ID = (short)pevlr->EventID;
	 //获得日期和时间
	 char chDate[50];
	 char chTime[50];
	 GetDateAndTime(pevlr->TimeWritten,chDate,chTime);
	 //获得事件类型
	 char data[20];
	 GetInicdentType(pevlr->EventType,data);
	 //获得事件来源
	 char chSource[1024];
	 pBuff = (LPSTR)((LPBYTE)pevlr+sizeof(EVENTLOGRECORD));
	 sprintf(chSource,pBuff );
	 //获得计算机名
	 pBuff += strlen(pBuff);
	 pBuff += 1;
	 char chComputerName[256];
	 swprintf(chComputerName,pBuff);
	 delete pchwBuff;
	 //获得用户名
	 char User[60] = "";
	 if(pevlr->UserSidLength>0)
	 {
	 char Name[64] = "";
	 DWORD Length = sizeof(SID), Length1 = sizeof(pBuff);
	 SID_NAME_USE Type = SidTypeUser;
	 SID *sid = (SID *)(pevlr + pevlr->UserSidOffset);
	 if(LookupAccountSidA(NULL, sid, Name, &Length, Buffer, &Length1, &Type))
	 sprintf(User, Name); //用户名
	 else
	 StrCpy(User,L"N/A");
	 }
	 else
	 StrCpy(User,L"N/A");

	 }

	 dwRead -= pevlr-> Length;
	 pevlr = (EVENTLOGRECORD *)
	 ((LPBYTE) pevlr + pevlr-> Length);
	 }

	 pevlr = (EVENTLOGRECORD *) &bBuffer;
	}
	CloseEventLog(hand);

	return TRUE;
	}

试试其它关键字

　事件信息　

同语言下

可能有用的

o330820350贡献的其它代码(1)

.获得计算机事件信息