无法在Visual C ++中使用WMI读取事件日志消息 [英] Unable to read Event Log messages Using WMI in Visual C++

问题描述

我正在尝试使用Visual C ++中的WMI从事件用户读取事件日志。

I am trying to read the event logs from the event user using WMI in Visual C++.

使用查询"SELECT * FROM Win32_NTLogEvent" 

While using the Query "SELECT * FROM Win32_NTLogEvent" 

然后我使用VARIANT对象来获取事件代码，事件类型和消息。

Then I am using a VARIANT object to get Event Code, Event Type, and message.

执行此操作时，事件日志未完全读取在一定数量的日志文件后停止。

While doing this I the event logs are not read fully it stops after a certain number of logs files.

为什么会发生这种情况如何解决？

Why does this happen How to resolve this??

VARIANT vtProp;

VARIANT vtProp;

hres = pclsObj-> Get（L" EventCode"，0，& vtProp，0,0）;

hres = pclsObj->Get(L"EventCode", 0, &vtProp, 0, 0);

wcout<< "事件代码："<< vtProp.uintVal<< "&NBSP; &NBSP;英寸;

wcout<< "Event Code : "<< vtProp.uintVal << "   ";

VariantClear（安培; vtProp）;

VariantClear(&vtProp);

hres = pclsObj->Get(L"Message", 0, &vtProp, 0, 0);			

wcout<< "消息："<< vtProp.bstrVal<< "&NBSP; &NBSP;英寸;

wcout<< "Message : "<< vtProp.bstrVal << "   ";

VariantClear（安培; vtProp）;

VariantClear(&vtProp);

hres = pclsObj-> Get（L" RecordNumber"，0，& vtProp，0,0 ）;

hres = pclsObj->Get(L"RecordNumber", 0, &vtProp, 0, 0);

wcout<< "记录号："<< vtProp.uintVal<< "&NBSP; &NBSP;英寸;

wcout<< "Record Number : "<< vtProp.uintVal << "   ";

VariantClear（安培; vtProp）; hres = pclsObj-> Get（L"SourceName"，0，& vtProp，0,0）; wcout<< "来源名称：" << vtProp.bstrVal<< "&NBSP; &NBSP;英寸; VariantClear（安培; vtProp）; hres = pclsObj-> Get（L" Logfile"，0，& vtProp，0,0）; wcout<< "日志文件：" << vtProp.bstrVal<< ENDL; VariantClear（& vtProp）;

VariantClear(&vtProp); hres = pclsObj->Get(L"SourceName", 0, &vtProp, 0, 0); wcout<< "Source Name: " << vtProp.bstrVal << "   "; VariantClear(&vtProp); hres = pclsObj->Get(L"Logfile", 0, &vtProp, 0, 0); wcout<< "Log File : " << vtProp.bstrVal << endl; VariantClear(&vtProp);

推荐答案

感谢您在这里发帖。

我测试了一个样本我已在此
链接中找到。它工作正常，似乎你的代码很好。

I tested a sample which I have found in this link. It works fine, it seems that your code is fine.

如果可能的话，你是否愿意为我们提供一个简单的样本来重现你的问题。 

If possible, would you mind to provide a simple sample for us to reproduce your issue. 

祝福，

杰克

这篇关于无法在Visual C ++中使用WMI读取事件日志消息的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！