您可以使用Win32_NTLogEvent http://msdn.microsoft.com/en-us/library/windows/desktop/aa394226%28v=vs.85%29.aspxWMI 类读取 Windows 日志的内容。
尝试这个示例
{$APPTYPE CONSOLE}
{$R *.res}
uses
SysUtils,
ActiveX,
ComObj,
Variants;
procedure GetLogEvents;
const
wbemFlagForwardOnly = $00000020;
var
FSWbemLocator : OLEVariant;
FWMIService : OLEVariant;
FWbemObjectSet: OLEVariant;
FWbemObject : OLEVariant;
oEnum : IEnumvariant;
iValue : LongWord;
begin;
FSWbemLocator := CreateOleObject('WbemScripting.SWbemLocator');
FWMIService := FSWbemLocator.ConnectServer('localhost', 'root\CIMV2', '', '');
FWbemObjectSet:= FWMIService.ExecQuery('SELECT Category,ComputerName,EventCode,Message,RecordNumber FROM Win32_NTLogEvent Where Logfile="System"','WQL',wbemFlagForwardOnly);
oEnum := IUnknown(FWbemObjectSet._NewEnum) as IEnumVariant;
while oEnum.Next(1, FWbemObject, iValue) = 0 do
begin
Writeln(Format('Category %s',[String(FWbemObject.Category)]));
Writeln(Format('Computer Name %s',[String(FWbemObject.ComputerName)]));
Writeln(Format('EventCode %d',[Integer(FWbemObject.EventCode)]));
Writeln(Format('Message %s',[String(FWbemObject.Message)]));
Writeln(Format('RecordNumber %d',[Integer(FWbemObject.RecordNumber)]));
FWbemObject:=Unassigned;
end;
end;
begin
try
CoInitialize(nil);
try
GetLogEvents;
finally
CoUninitialize;
end;
except
on E:EOleException do
Writeln(Format('EOleException %s %x', [E.Message,E.ErrorCode]));
on E:Exception do
Writeln(E.Classname, ':', E.Message);
end;
Writeln('Press Enter to exit');
Readln;
end.
如需更多示例,请尝试此博客条目WMI Tasks using Delphi – Event Logs http://theroadtodelphi.wordpress.com/2011/10/27/wmi-tasks-using-delphi-%E2%80%93-event-logs/