var
hEventLog: THandle;
NumberOfRecords: DWORD;
Buffer: PEVENTLOGRECORD;
BytesRead, MinNumberOfBytesNeeded: DWORD;
begin
Memo1.Lines.BeginUpdate;
try
hEventLog:=OpenEventLog(nil, 'SYSTEM');
if hEventLog=0 then RaiseLastOSError;
if GetNumberOfEventLogRecords(hEventLog, NumberOfRecords) then Memo1.Lines.Add('NumberOfRecords = '+IntToStr(NumberOfRecords));
Buffer:=GetMemory($10000);
while True do
begin
if not ReadEventLog(hEventLog, EVENTLOG_SEQUENTIAL_READ or EVENTLOG_BACKWARDS_READ, 0, Buffer, 0, BytesRead, MinNumberOfBytesNeeded) then
begin
if GetLastError<>ERROR_INSUFFICIENT_BUFFER then Break;
if not ReadEventLog(hEventLog, EVENTLOG_SEQUENTIAL_READ or EVENTLOG_BACKWARDS_READ, 0, Buffer, MinNumberOfBytesNeeded, BytesRead, MinNumberOfBytesNeeded) then Break;
if PChar(Integer(Buffer)+SizeOf(EVENTLOGRECORD))='Microsoft-Windows-Kernel-General' then
begin
if Buffer^.EventID in [12, 13] then
Memo1.Lines.Add('RecordNumber = '+IntToStr(Buffer^.RecordNumber)+' '+PChar(Integer(Buffer)+SizeOf(EVENTLOGRECORD))+' TimeGenerated = '+DateTimeToStr(UnixToDateTime(Buffer^.TimeGenerated))+' EventID = '+IntToStr(Buffer^.EventID));
end;
end else Break;
end;
FreeMemory(Buffer);
CloseEventLog(hEventLog);
finally
Memo1.Lines.EndUpdate;
end;
end;
выводит все события "Системное время запуска операционной системы" и "Системное время завершения работы операционной системы".