Read NT Event Log with VC++.NET

[kevin.horgan]

Hello,

I need to write a short utility to read NT 4 and Win 2000 server's Event Logs in VC++ .NET. Does anyone have any advise on how best I can open the event log file and read the entries.

Thanks in advance,

Kevin

[Y.H Liu]

There are three Win32 API associated with:
RegisterEventSource
ReportEvent
DeregisterEventSource

And, if you create a NT service using ATL, you will find some code using above APIs.

[kevin.horgan]

The following code uses the EventLog Class in VC++.NET to loop through the Event Log and display each entry to the Console.

Cheers

Kevin


#include "stdafx.h"

#using "mscorlib.dll"
#using "System.dll"
#include "tchar.h"

using namespace System;
using namespace System::Diagnostics;

int _tmain(void)
{
// Associate the instance of 'EventLog' with "Event Log Type" and
// "Machine Name" Log.
//
// "Event Log Type" = Application or System or Security
// "Machine Name" = "." is the Localhost or remote host name
//
EventLog *myEventLog = new EventLog("Application", ".");

EventLogEntryCollection *myLogEntryCollection=myEventLog->Entries;
int myCount = myLogEntryCollection->Count;

// Iterate through all 'EventLogEntry' instances in 'EventLog'.
for(int i = myCount - 1; i > 0; i--)
{
EventLogEntry *myLogEntry = myLogEntryCollection->get_Item(i);
DateTime myLogEntryTime = myLogEntry->get_TimeGenerated();

// Display Source, Message and Generated time of the event.
Console::WriteLine("Event Source : {0}", myLogEntry->Source);
Console::WriteLine("Event Message : {0}", myLogEntry->get_Message());
Console::WriteLine("Generated date/time : {0}\n", __box(myLogEntryTime));
}
return 0;
}

[kevin.horgan]

#include "stdafx.h"

#using <mscorlib.dll>
#using <System.dll>
#include <tchar.h>

using namespace System;
using namespace System::Diagnostics;

int _tmain(void)
{
// Associate the instance of 'EventLog' with "Event Log Type" and
// "Machine Name" Log.
//
// "Event Log Type" = Application or System or Security
// "Machine Name" = "." is the Localhost or remote host name
//
EventLog *myEventLog = new EventLog("Security", ".");

EventLogEntryCollection *myLogEntryCollection=myEventLog->Entries;
int myCount = myLogEntryCollection->Count;

// Iterate through all 'EventLogEntry' instances in 'EventLog'.
for(int i = myCount - 1; i > 0; i--)
{
EventLogEntry *myLogEntry = myLogEntryCollection->get_Item(i);
DateTime myLogEntryTime = myLogEntry->get_TimeGenerated();

// Display Source, Message and Generated time of the event.
Console::WriteLine("Event Source : {0}", myLogEntry->Source);
Console::WriteLine("Event ID : {0}", __box(myLogEntry->get_EventID()));
Console::WriteLine("Event Message : {0}", myLogEntry->get_Message());
Console::WriteLine("Generated date/time : {0}\n", __box(myLogEntryTime));
}
return 0;
}