0

它即将从远程机器收集事件查看器的日志。到目前为止，我已经尝试过 Event Logging api。虽然，它通过从本地主机读取日志运行良好，但无法从远程机器读取。

HANDLE OpenEventLogA(
  [in] LPCSTR lpUNCServerName,
  [in] LPCSTR lpSourceName
);

使用它，我尝试通过在 UNCServerName 的位置提及远程机器的 ipaddress 来打开事件日志。但是，它不起作用。下面是代码，到目前为止我已经尝试过了。

#include <windows.h>
#include <stdio.h>
#include <bits/stdc++.h>  
#include <winbase.h>
#include<string.h>
#include <iostream>  
#include<vector>

#define BUFFER_SIZE 1024*200
#define MAX_TIMESTAMP_LEN       23 + 1 
#define MAX_WORD_LEN       1000 

using namespace std;


struct SearchRecord {
    string type;
    string time;
    string source;
    string eid;

};
void FillEventRecordDetails(std::vector<SearchRecord*> *searchRecordResult)
{

    HANDLE h;
    int i=1,j=0;
    EVENTLOGRECORD *pevlr;
    BYTE bBuffer[BUFFER_SIZE];
    DWORD dwRead, dwNeeded, dwRecord,dwThisRecord;

    // Open the Application event log.
    h = OpenEventLog(//ip address//,    
             "Application");   
    if (h == NULL)
    {
        cout<<GetLastError();
    }
    cout<<"HANDLE:"<<h;
    pevlr = (EVENTLOGRECORD *) &bBuffer;
    GetOldestEventLogRecord(h, &dwThisRecord);
    cout<<"Record Number:"<<dwThisRecord;
    GetNumberOfEventLogRecords(h, &dwRecord);
    cout<<"\n New:"<<dwRecord+dwThisRecord;
    while (ReadEventLog(h, EVENTLOG_SEEK_READ|               
                EVENTLOG_FORWARDS_READ , 
                dwThisRecord,            
                pevlr,        
                BUFFER_SIZE,  
                &dwRead,      
                &dwNeeded))   
    {   
        
        while (dwRead > 0 )
        {
            
            //TYPE
            string type;
            switch(pevlr->EventType)
            {
                case EVENTLOG_ERROR_TYPE:
                   type = "ERROR";
                    break;
                case EVENTLOG_WARNING_TYPE:
                    type = "WARNING";
                    break;
                case EVENTLOG_INFORMATION_TYPE:
                    type = "INFORMATION";
                    break;
                case EVENTLOG_AUDIT_SUCCESS:
                    type = "AUDIT_SUCCESS";
                    break;
                case EVENTLOG_AUDIT_FAILURE:
                    type = "AUDIT_FAILURE";
                    break;
                default:
                    type = "Unknown";
                    break;
            }

            //TIME
            DWORD Time = ((PEVENTLOGRECORD)pevlr)->TimeGenerated ;
            ULONGLONG ullTimeStamp = 0;
            ULONGLONG SecsTo1970 = 116444736000000000;
            SYSTEMTIME st;
            FILETIME ft, ftLocal;
            ullTimeStamp = Int32x32To64(Time, 10000000) + SecsTo1970;
            ft.dwHighDateTime = (DWORD)((ullTimeStamp >> 32) & 0xFFFFFFFF);
            ft.dwLowDateTime = (DWORD)(ullTimeStamp & 0xFFFFFFFF);   
            FileTimeToLocalFileTime(&ft, &ftLocal);
            FileTimeToSystemTime(&ftLocal, &st);   
            ostringstream mon1 , day1 ,year1,hour1,min1,sec1,mil1; 
            mon1 << st.wMonth ;day1 << st.wDay ;year1 << st.wYear ;hour1 << st.wHour ;min1 << st.wMinute ;sec1 << st.wSecond ;mil1 <<st.wMilliseconds;
            string mon = mon1.str();string day = day1.str();string year = year1.str();string hour = hour1.str();string min = min1.str();string sec = sec1.str();
            string mil=mil1.str();
            string time = day+"-"+mon+"-"+year+" "+hour+":"+min+":"+sec+":"+mil;

            int id = ((PEVENTLOGRECORD)pevlr)->EventID & 0xFFFF;
            ostringstream temp;
            temp << id;
            string eid = temp.str();  


            string source =  (LPSTR) ((LPBYTE) pevlr + sizeof(EVENTLOGRECORD));


            SearchRecord *pRecord = new SearchRecord();
            pRecord->type = type;
            pRecord->time = time;
            pRecord->eid = eid;
            pRecord->source = source;
            searchRecordResult->push_back(pRecord);
            cout<<i;  
            cout<<" Type:"<<type;
            cout<<" Time:"<<time;
            cout<<" Event Id:"<<id;
            cout<<" source:"<<source;
            cout<<"\n";
            i++;
            dwRead -= pevlr->Length;
            pevlr = (EVENTLOGRECORD *)
                ((LPBYTE) pevlr + pevlr->Length);

        }
        dwThisRecord+=i;
        pevlr = (EVENTLOGRECORD *) &bBuffer;
    }

    CloseEventLog(h);

}
int main()
{  
    vector<SearchRecord*> searchRecordResult ;
    FillEventRecordDetails(&searchRecordResult);
}

有没有办法使用 C++ 代码从远程机器读取日志？

提前致谢。

4

0 回答 0