이벤트 로그 관련

컴퓨터 관리에 보면 이벤트로그가 존재한다.
이곳에서는 어플리케이션의 비정상적인 동작들이나
보안로그(터미널 접속)등 로그들을 관리하게 된다.
이번 프로젝트에서 필요한 기능이라 추가해보려고 잠시 살펴보았다.



[Managing Windows with WMI]


Event Logging Functions

The following functions are used with event logging.

Function	Description
BackupEventLog	Saves the specified event log to a backup file.
ClearEventLog	Clears the specified event log, and optionally saves the current copy of the logfile to a backup file.
CloseEventLog	Closes a read handle to the specified event log.
DeregisterEventSource	Closes a write handle to the specified event log.
GetEventLogInformation	Retrieves information about the specified event log.
GetNumberOfEventLogRecords	Retrieves the number of records in the specified event log.
GetOldestEventLogRecord	Retrieves the absolute record number of the oldest record in the specified event log.
NotifyChangeEventLog	Enables an application to receive notification when an event is written to the specified event logfile.
OpenBackupEventLog	Opens a handle to a backup event log.
OpenEventLog	Opens a handle to an event log.
ReadEventLog	Reads a whole number of entries from the specified event log.
RegisterEventSource	Retrieves a registered handle to an event log.
ReportEvent	Writes an entry at the end of the specified event log.

원문 : MSDN


[샘플]

기능 : 이벤트 뷰어의 보안의 로그를 삭제한다.

BOOL MyClearLog(LPTSTR pszSrcName ) // event source name
{
  HANDLE hEventLog;
  BOOL bSuccess;

  hEventLog = OpenEventLog(NULL, pszSrcName);
  if (NULL == hEventLog)
  {
     printf("Open event log failed.\n");
     return FALSE;
  }

  bSuccess = ClearEventLog(hEventLog, NULL);

  CloseEventLog(hEventLog);
  return bSuccess;
}

int main(int argc, char* argv[])
{
if ( TRUE == MyClearLog("Security") ) // 한글로 보안 치는거 아님 ^^;  
printf("Success");

return 0;
}