GetNumberOfEventLogRecords 返回错误数量的事件日志 [英] GetNumberOfEventLogRecords returns incorrect number of event logs

问题描述

我有这个 C++ 代码来读取事件日志记录

I have this C++ code to read the event log records

DWORD GetLogRecords(LPCWSTR wsLogFile)
{
  HANDLE hEvt = OpenEventLog(NULL, wsLogFile);
  if (hEvt==NULL) return 0;

  DWORD dwTotalRecords;
  BOOL res = GetNumberOfEventLogRecords(hEvt, &dwTotalRecords);
  CloseEventLog(hEvt);

  return (res != 0) ? dwTotalRecords : 0;
}

结果

atlTraceGeneral - C:Windowssystem32winevtlogsACEEventLog.evtx - 23499 Total Records
atlTraceGeneral - C:Windowssystem32winevtlogsApplication.evtx - 23499 Total Records
atlTraceGeneral - C:Windowssystem32winevtlogsConnectionInfo.evtx - 23499 Total Records
atlTraceGeneral - C:Windowssystem32winevtlogsError.evtx - 23499 Total Records
atlTraceGeneral - C:Windowssystem32winevtlogsHardwareEvents.evtx - 23499 Total Records
atlTraceGeneral - C:Windowssystem32winevtlogsInternet Explorer.evtx - 23499 Total Records
atlTraceGeneral - C:Windowssystem32winevtlogsKey Management Service.evtx - 23499 Total Records
 ...

我已使用计算机上所有 .EVTX 日志文件的完整路径(150 个日志文件)调用此函数.并且每次返回 23499 ！我的日志文件有不​​同的大小，有些是 0，为什么我总是得到 23499?

I have called this function with the full path of all the .EVTX log files on my computer (150 log files). And each time it returns 23499 ! My log files have different sizes and some 0, why I always get 23499 ?

UPDATE2:现在清除应用程序日志后，所有 .evtx 日志文件都为 0.我认为它总是获取应用程序日志而不是指定的 .evtx 文件.

UPDATE2: After I have cleared the Application logs now I get 0 for all the .evtx log files. I think it always gets the application log instead of the specified .evtx file.

更新:正如 Remy Lebeau 建议的那样，但结果仍然相同.

UPDATE: As Remy Lebeau suggested, but still the same result.

推荐答案

为了他人的利益，这个问题的解决方案是 OpenEventLog 不接受路径名.相反，您必须为其提供事件日志的源名称(类似于 "HardwareEvents").

For the benefit of others, the solution to this problem is that OpenEventLog doesn't accept a pathname. Instead you have to give it the source name of the event log (something like "HardwareEvents").

如果您使用无效的源名称(包括提供路径名)调用 OpenEventLog，则如文档所述，它将打开 Application 日志:

If you call OpenEventLog with an invalid source name (which includes providing a pathname), then as documented it will open the Application log instead:

如果您指定自定义日志并且找不到，则事件日志记录服务打开应用程序日志.

If you specify a custom log and it cannot be found, the event logging service opens the Application log.

这篇关于GetNumberOfEventLogRecords 返回错误数量的事件日志的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！