C++如何使用EventLog实时读取Windows系统日志？

Question

    EventLog^ log = gcnew EventLog();
    log->Log = ("system");
    EventLogEntryCollection^ myCollection = log->Entries;

    for each (EventLogEntry^ test in myCollection)
    {
        Console::WriteLine(test->Message);
        Console::WriteLine(test->TimeWritten);

    }

    system("pause");

通过以上程序可以直接读取Windows系统日志，但却是一次性的；
如何实时监控，一有日志出现就读取出来

Answer 1

以EventLogEntryCollection的Count方式来进行计数，发现最新日志数量比第一次读取的日志数量多了就顺序读取，少了则代表日志重置，从新读取

    while (1)
    {
        //应用日志实时读取
        log->Log = ("Application");
        EventLogEntryCollection^ myApplication = log->Entries;
        if (myApplication->Count > AppliNum)  //如有新日志，则按序输出
        {
            const char* Message = (const char*)(Marshal::StringToCoTaskMemAnsi(myApplication[AppliNum]->Message)).ToPointer();
            const char* TimeWritten = (const char*)(Marshal::StringToCoTaskMemAnsi(myApplication[AppliNum]->TimeWritten.ToString())).ToPointer();
            string Msg = Message;
            string Time = TimeWritten;
            Client(Time, Msg);
            AppliNum++;
        }
        else if (myApplication->Count < AppliNum) //表示日志以重置
        {
            for each (EventLogEntry^ var in myApplication)
            {
                const char* Message = (const char*)(Marshal::StringToCoTaskMemAnsi(var->Message)).ToPointer();
                const char* TimeWritten = (const char*)(Marshal::StringToCoTaskMemAnsi(var->TimeWritten.ToString())).ToPointer();
                string Msg = Message;
                string Time = TimeWritten;
                Client(Time, Msg);
            }
            AppliNum = myApplication->Count;
        }
}