Displaying the Local Time for an Event
The following example displays the time information for an event. The function parameter is a pointer to the EVENTLOGRECORD structure. The function has no return value.
#include <stdafx.h>
#include <windows.h>
#include <iostream>
#define BUFFER_SIZE 512
void __cdecl wmain(int argc, LPWSTR *argv)
{
// Name of the event log.
wchar_t *logName = L"Application";
HANDLE h;
EVENTLOGRECORD *pevlr;
BYTE bBuffer[BUFFER_SIZE];
DWORD dwRead, dwNeeded, dwThisRecord;
LPCTSTR lpSourceName;
// Open the event log.
h = OpenEventLog( NULL, // Use the local computer.
logName);
if (h == NULL)
{
std::wcout << L"Could not open the event log." << std::endl;;
return;
}
// Initialize the event record buffer.
pevlr = (EVENTLOGRECORD *) &bBuffer;
// Get the record number of the oldest event log record.
GetOldestEventLogRecord(h, &dwThisRecord);
// When the event log is opened, the position of the file pointer
// is at the beginning of the log. Read the event log records
// sequentially.
ReadEventLog(h, // Event log handle
EVENTLOG_FORWARDS_READ | // Reads forward
EVENTLOG_SEQUENTIAL_READ, // Sequential read
0, // Ignored for sequential read
pevlr, // Pointer to buffer
BUFFER_SIZE, // Size of buffer
&dwRead, // Number of bytes read
&dwNeeded); // Bytes in the next record
if (dwRead > 0)
{
// Get the event source name.
lpSourceName = (LPCTSTR) ((LPBYTE) pevlr + sizeof(EVENTLOGRECORD));
// Print the event identifier and event source.
std::wcout << L"Event ID: " << pevlr->EventID << std::endl;
std::wcout << L"Event Source: " <<
lpSourceName << std::endl;
// Display the local time for the event.
FILETIME FileTime, LocalFileTime;
SYSTEMTIME SysTime;
__int64 lgTemp;
__int64 SecsTo1970 = 116444736000000000;
lgTemp = Int32x32To64(pevlr->TimeGenerated,10000000) + SecsTo1970;
FileTime.dwLowDateTime = (DWORD) lgTemp;
FileTime.dwHighDateTime = (DWORD)(lgTemp >> 32);
FileTimeToLocalFileTime(&FileTime, &LocalFileTime);
FileTimeToSystemTime(&LocalFileTime, &SysTime);
printf("Time Generated: %02d/%02d/%02d %02d:%02d:%02d\n",
SysTime.wMonth,
SysTime.wDay,
SysTime.wYear,
SysTime.wHour,
SysTime.wMinute,
SysTime.wSecond);
}
// Close the event log.
CloseEventLog(h);
}
Send comments about this topic to Microsoft
Build date: 3/29/2009