====== Unit eventlog ====== ===== Class TDLLCache ===== Is intended for a storage of the list of the loaded dynamic libraries used At formation of the texts of the messages at decoding records of a magazine of events. Is used inside a class TEventLogRecordDecoder. ==== Methods ==== *function LoadLibrary (const Name: string; FLags: DWORD): HInstance; \\ Loads library and returns their descriptor. *procedure UnloadLibrary (const Name: string); \\ Unloads library. *procedure UnloadAll; \\ Unloads all loaded libraries. ===== Class TEventLogRecordDecoder ===== Is intended for decoding the given record of a magazine of events. The majority of properties correspond to fields of structure EVENTLOGRECORD. Their detailed description is in the MSDN. ==== Methods ==== *constructor Create (const ALogName: string); \\ ALogName a name of a magazine. Owes the part of a name of one of subkeys of a key "HKLM\SYSTEM\CurrentControlSet\Services\Eventlog" of the register, it is usual "Application", "System" and "Security". It is possible also to set this name through property LogName. *procedure Reset; \\ unloads all loaded at decoding dynamic Libraries. *procedure GetRawData (Stream: TStream); \\ Keeps in a flow Stream binary given, contained in record about event. The index on this block given can be received also from property Data, and Length - from DataLength. *procedure GetRawRecord (Stream: TStream); \\ Keeps in a flow Stream contents of record of a magazine wholly. *procedure ValidateRecord; \\ Carries out check of a format of record, and if it does not correspond to a format, raises exception EInvalidEventLogRecord. ==== Properties ==== *property RecPtr: PEVENTLOGRECORD read FRecPtr write FRecPtr; \\ Is intended for the task of the index for structure EVENTLOGRECORD, which data it's necessary to read. *property LogName: string read FLogName write FLogName; \\ Is intended for the task of a name of a magazine. ===== Class TEventLog ===== ==== Methods ==== *procedure Open; \\ Opens a magazine of events given by property LogName. *procedure OpenBackup (const BackupName: string); \\ Opens a backup copy of a magazine. *procedure Close; \\ Closes a magazine of events *procedure Clear (const BackupName: string = "); \\ Clears a magazine of events. The magazine should be open. If parameter is given BackupName, the backup copy of a magazine is created. *procedure Backup (const BackupName: string); \\ Creates a backup copy of a magazine. *function CreateIterator (Direction: TLogIterateDirection=idBackward): TEventLogIterator; \\ Creates and returns iterator, connected with the given copy of a class TEventLog. ==== Properties ==== *property Active: boolean read GetActive write SetActive; \\ Shows is open or the magazine is closed. *property Count: DWORD read GetCount; \\ Quantity of records in the magazine *property Handle: THandle read FHandle; \\ Descriptor of an open magazine. *property LogName: string read FLogName write SetLogName; \\ Sets a name of a magazine. *property OldestRecord: DWORD read GetOldestRecord; \\ Number of the oldest record in a magazine. *property RegKey: string read GetRegKey; \\ Name of a root key of the register for the chosen magazine. ===== Class TEventLogIterator ===== Is intended for moving on an open magazine of the messages, gives an access to the current record. ==== Methods ==== *constructor Create (AEventLog: TEventLog; ADirection: TLogIterateDirection); \\ AEventLog - the Copy of a class TEventLog, for which is created iterator; \\ ADirection - sets a direction of pass on a magazine. *function IsEmpty: boolean; \\ Returns true if the magazine is empty. *procedure Reset; \\ Resets the current iterator's condition and passes, depending on given Directions of detour, to first or last record in a magazine. A call Reset Is necessary, for example, in the event that was changed name of a magazine in The appropriate copy of a class TEventLog. *function IsDone: boolean; *function Next: boolean; \\ Transition to the following record in a magazine in conformity with the chosen direction detour. *function Seek (Number: DWORD): boolean; \\ Transition to record of a magazine with given number. ==== Properties ==== *property Current: TEventLogRecordDecoder read GetCurrent; \\ Gives access to the current record of a magazine. *property EventLog: TEventLog read FEventLog write SetEventLog; \\ The copy of a class TEventLog, with which is connected to the given copy iteratorŠ°. *property Direction: TLogIterateDirection read FDirection write SetDirection; \\ The direction, in which goes moving on a magazine by a call Next. ==== Dependences ==== Classes, SysUtils, Registry, Windows, JwaWinType, JwaWinBase, JwaWinNT ==== Restrictions ==== D5, D6, WinNT, Win2000, should work under WinXP