1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:

type
   TEventLog=class(TObject)
      private
         heventsource:Cardinal;
         myBasePath:STring;


      public
         procedure SetAppSettings(InternalLogName:pchar;
                                AppName:pchar;
                                CatMsgFile:pchar;
                                EvMsgFile:pchar;
                                ParamMsgFile:pchar;
                                CatCount:integer;
                                TypesSupported:integer);


         procedure CreateEventLog(BasePath:pchar;InternalLogName:pchar);


         procedure ConnectToEventLog(InternalLogName:pchar);
        // procedure DisconnectEventLog;
         procedure WriteEntry(Typ,
                               Category: word;
                               EventID: integer;
                               UserSID: psid;
                               Entrys:array of pchar);

         constructor Create;
   end;

var gEventLog:TEventLog;

const

   REG_EVL_BASE_PATH='SYSTEM\CurrentControlSet\Services\Eventlog\';



implementation

uses UTCustomRegistry, Classes, Sysutils;

{ TEventLog }

//------------------------------------------------------------------------------
constructor TEventLog.Create();
//------------------------------------------------------------------------------
begin
   inherited Create;
   heventsource:=0;

end;

//------------------------------------------------------------------------------
procedure TEventLog.CreateEventLog(BasePath:pchar; InternalLogName:pchar);
//------------------------------------------------------------------------------
var Reg:TCustomRegistry;
SrcVal:TStringlist;
begin

   myBasePath:=BasePath;
   myBasePath:=ExcludeTrailingBackslash(myBasePath)+'\';

   Reg:=TCustomRegistry.Create;
   reg.RootKey:=HKEY_LOCAL_MACHINE;
   if not Reg.KeyExists(REG_EVL_BASE_PATH+'\'+InternalLogName) then
   begin
      myBasePath:=excludetrailingbackslash(myBasePath)+'\';

      Reg.OpenKey(REG_EVL_BASE_PATH+'\'+InternalLogName,true);
      Reg.WriteExpandString('DisplayNameFile',myBasePath+'Msg.dll'); //LogName Res Datei
      Reg.WriteInteger('DisplayNameID',1); //ID Des LogNamens im ResFile;
      Reg.WriteExpandString('File','%SystemRoot%\System32\Config\'+InternalLogName+'.evt'); //Datei in der Events gespeichert werden
      Reg.WriteInteger('MaxSize',5177344); //Maximalgröße des Logs
      Reg.WriteString('PrimaryModule',InternalLogName); //Default Modul aus dem ResStrings geladen werden wenn das jeweilige res file nicht gefunden wird.
      Reg.WriteInteger('Retention',604800); //Zeit nach dem einträge gelöscht werden
      SrcVal:=TStringlist.Create;
      SrcVal.Add(InternalLogName);
      Reg.WriteMultiSZ('Sources',SrcVal);
      SrcVal.free;


      SetAppSettings(InternalLogName,InternalLogName,
                   pchar(myBasePath+'Msg.dll'),
                   pchar(myBasePath+'Msg.dll'),
                   pchar(myBasePath+'Msg.dll'),
                   0,
                   EVENTLOG_SUCCESS OR EVENTLOG_ERROR_TYPE OR EVENTLOG_WARNING_TYPE OR EVENTLOG_INFORMATION_TYPE OR EVENTLOG_AUDIT_SUCCESS OR EVENTLOG_AUDIT_FAILURE);

   end;
   Reg.CloseKey;
   reg.Free;
end;



//------------------------------------------------------------------------------
procedure TEventLog.SetAppSettings(InternalLogName:pchar;
                                AppName:pchar;
                                CatMsgFile:pchar;
                                EvMsgFile:pchar;
                                ParamMsgFile:pchar;
                                CatCount:integer;
                                TypesSupported:integer);
//------------------------------------------------------------------------------
var reg:TCustomRegistry;
begin

   Reg:=TCustomRegistry.Create;
   reg.RootKey:=HKEY_LOCAL_MACHINE;
   //Untereintrag als Applikation

      Reg.OpenKey(REG_EVL_BASE_PATH+'\'+InternalLogName+'\'+AppName,true);
      Reg.WriteInteger('CategoryCount',CatCount);                 //Anzahl Kategorieren dieser Applikation
      Reg.WriteExpandString('CategoryMessageFile',CatMsgFile);    //Datei aus der die Kategorien gelesen werden
      Reg.WriteExpandString('EventMessageFile',EvMsgFile);        //Datei aus der die Beschriftungen der EventIDs gelesen werden
      Reg.WriteExpandString('ParameterMessageFile',ParamMsgFile); //Datei aus der die Parameter der Eventbeschreibung gelesen werden
      Reg.WriteInteger('TypesSupported',TypesSupported);          //Unterstützte Log Typen
  reg.CloseKey;
  reg.Free;


end;

//------------------------------------------------------------------------------
procedure TEventLog.ConnectToEventLog(InternalLogName:pchar);
//------------------------------------------------------------------------------
begin

   heventsource:=Windows.RegisterEventSource(nil,InternalLogName);

end;

//------------------------------------------------------------------------------
procedure TEventLog.WriteEntry(Typ,
                               Category: word;
                               EventID: integer;
                               UserSID: psid;
                               Entrys:array of pchar);
//------------------------------------------------------------------------------
var
   sstring: array of string;
   n:integer;
begin
   SetLength(sstring,length(Entrys));
   for n := 0 to length(Entrys) - 1 do
   begin
      sstring[n]:=Entrys[n];
   end;

   n:=length(Entrys);

     if hEventSource > 0 then
     begin

       ReportEvent(hEventSource, // event Source Handle
                           typ,  // event typ
                      category,  // event category
                       EventID,  // event identifier
                       UserSID,  // user security identifier (optional)
                             n,  // number of strings to merge msg
                             0,  // size of binary data, in bytes
                       @Entrys,  // array of strings to merge with msg
                          nil);  // address of binary data

     end;
end;                    

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Diagnostics;

namespace WindowsApplication1
{
    public partial class Form1 : Form
    {
        private EventLog EVL1,EVL2;

        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            if (!EventLog.SourceExists("MeineQuelle1")) 
            {
                EventLog.CreateEventSource("RCI-Server","BeispielLog");
            }

            if (!EventLog.SourceExists("MeineQuelle2")) 
            {
                EventLog.CreateEventSource("MeineQuelle2", "BeispielLog");
            }

            EVL1 = new EventLog("BeispielLog", System.Environment.MachineName, "MeineQuelle1");
            EVL2 = new EventLog("BeispielLog", System.Environment.MachineName, "MeineQuelle2");
            EVL1.WriteEntry("Nachricht von 1");
            EVL2.WriteEntry("Nachricht von 2");
            

        }
    }
}