想请问怎么持续获取最新的Windows日志内容，用c或者c++代码，或者帮我修改一下我的代码

Question

//代码是想持续只读取最新的Windows日志内容，并转成syslog形式进行发送，但是不知道怎么获取message部分的内容，而且我的代码有一个问题，就是获取缓冲区的数据的时候，应该要从最新的地方读取才对，但是我不知道怎么从最新的地方读取，并且如果程序一直运行的话，缓冲区空间总会为空的
int main()
    int set_num3 = 0;
    DWORD dwRead, dwNeeded, dwThisRecord, dwRecordCount, dwRecordNumber;
    string Source;
    time_t Time;
    unsigned short ID;
    EVENTLOGRECORD* pevlr;
    char* Data = new char[set_char]; //缓冲区大小，如果太小读到的记录会少于windows日志
    HANDLE Log = OpenEventLog(NULL, "System");//第一次参数表示本地计算机，第二个参数表示系统日志
    if (Log == NULL)
    {
        cout << "==" << endl;
        return 0;
    }
    GetOldestEventLogRecord(Log, &dwThisRecord);
    int a = 0;

    while (true)
    {
        if (a = ReadEventLog(Log, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, 0, Data, set_char, &dwRead, &dwNeeded))
        {

            for (DWORD i = 0; i < dwRead;)
            {
                EVENTLOGRECORD* ptr = (EVENTLOGRECORD*)(Data + i);
                Source = (TCHAR*)ptr + sizeof(EVENTLOGRECORD);//事件源
                ID = (unsigned short)ptr->EventID;//事件ID
                //&& Source != "EventLog"
                /*if (Source != "Microsoft-Windows-Kernel-General")
                {
                    i += ptr->Length;
                    continue;
                }*/
                struct tm SysStartupTime;//时间结构体
                Time = ptr->TimeGenerated;//日期和时间
                char buf[64]{ 0 };//用来存放时间
                localtime_s(&SysStartupTime, &Time);//时间戳转化为格式时间
                strftime(buf, _countof(buf), "%Y-%m-%d %H:%M:%S", &SysStartupTime);//格式化时间到缓冲区
                char* pchar = (TCHAR*)ptr + sizeof(EVENTLOGRECORD);
                pchar += (strlen(pchar) + 1);
                string UserID = pchar;
                string User;
                pchar += strlen(pchar) + 1;
                char Buffer[1024];

                if (ptr->UserSidLength > 0)
                {
                    char Name[64];
                    DWORD Length = sizeof(SID), Length1 = sizeof(Buffer);
                    SID_NAME_USE Type = SidTypeUser;
                    SID* sid = (SID*)(Data + ptr->UserSidOffset);
                    if (LookupAccountSid(NULL, sid, Name, &Length, Buffer, &Length1, &Type))
                        User = Name;
                }
                //cout << "---------------系统--------------" << endl;
                //cout << "事件:";
                string Type;
                switch (ptr->EventType)
                {
                case 0: Type = "2"; break;
                case 1: Type = "3"; break;
                case 2: Type = "4"; break;
                case 4: Type = "5"; break;
                default:continue;
                }
                if (set_num3 == 1)
                {
                    string str;
                    str += "<";
                    str += Type;
                    str += ">";
                    //    str += "Time:";
                    str += buf;
                    str += " ";
                    //    str += " Hostname:";
                    str += UserID;
                    str += " ";
                    //    str += " APPNANME:";
                    str += (char*)(LPBYTE)ptr + sizeof(EVENTLOGRECORD);
                    str += ": ";
                    //    str += " ID:";
                    str += to_string(ID);
                    str += " ";
                    //    str += pchar;


                    if (ptr->DataOffset > ptr->StringOffset)
                    {
                        pchar = Data + i + ptr->StringOffset;

                        //printf("%s \n", pchar);
                        str += pchar;
                        for (short j = 0; j < ptr->NumStrings; j++)
                        {
                            pchar += strlen(pchar)+1 ;
                            //cout << pchar << endl;
                            str += " ";
                            str += pchar;
                        }
                    }
                    cout << str << endl;
                }
                //cout << "----------" << str << "-----------" << endl;

                i += ptr->Length;
                //cout << endl;
            }
        }
        else
        {
            set_num3 = 1;
        }
    }
    delete[] Data;
    CloseEventLog(Log);

Answer 1

别用al。al我都试了一周了，给不出答案的，而且al给的代码就有问题