|
I am trying to pull specific information from the Security Event Log in windows 2000, in Visual C++ 6 for a auditing system I am creating. Using information from MSDN I have been able to extract the event number, the time it occurred, and the user who triggered the event. The last thing i need is the file that was modified. I know this only applies to certain events. How can i get the file that was accessed/modified/deleted? I have not been able to find a clear example. I've tried using GetEventLogInformation but i was unable to get it to work. I also tried get the message map but I failed at that as well. Are either of these the correct approach? Anyone know of any examples? Any suggestions would be appricated.
|
|
|
|
|
jet9153 wrote:
The last thing i need is the file that was modified.
What file? The event file itself, or a file that an event message refers to?
"Opinions are neither right nor wrong. I cannot change your opinion of me. I can, however, change what influences your opinion." - David Crow
|
|
|
|
|
I configured auditing on a folder on my local hard drive. I want to know what file in that folder was accessed. I see it in Computer Management, when I double click certain events. I want to know how to get that file name from within a C++ application.
|
|
|
|
|
jet9153 wrote:
I want to know what file in that folder was accessed.
Would ReadDirectoryChangesW() or FindFirstChangeNotification() be of any help?
"Opinions are neither right nor wrong. I cannot change your opinion of me. I can, however, change what influences your opinion." - David Crow
|
|
|
|
|
Sorry but no, these functions do not help. I think i need to explain myself better. On my PC i set up auditing on a select folder, "C:\Image_Db". Any time someone looks at one of these files, deletes a file, changes a file, I want to know who did it, at what time, what file, and what they did to the file. The solution i found was to audit these files through windows event logs. Currently i have to manually find the 564 event and then find the corresponding 560 that gives the file name.
I recently discovered a set of API functions that allow for access to the event logs. I am able to get the eventID, the user, the time, but i can not figure out a way to get the file that was accessed. I think the filename is embedded in the EVENTLOGRECORD structure, after StringOffSet, as described in the MSDN website. I want to know how i can get that data out of the structure. I am not sure if this is possible and I have seen no reference to it on the internet. If you can point me in any direction what so ever i would be grateful.
If you know of a better way that i can log all changes made to a file i would like to hear it.
Thank you for all your help thus far.
|
|
|
|
|
jet9153 wrote:
Any time someone looks at one of these files, deletes a file, changes a file, I want to know who did it, at what time, what file, and what they did to the file.
While ReadDirectoryChangesW() or FindFirstChangeNotification() will tell you the file and the operation on it, the other criteria would need something like a file system driver that creates and attaches filter device objects to target file system device objects to see all IRPs and FastIO requests directed at those drives.
When looking at the event, where does the filename show up (e.g., in the Description box)? As you've found, the message itself is not written to the event log, only the event's id. You'll need to use EventID and SourceName to locate the event in the message DLL.
"Opinions are neither right nor wrong. I cannot change your opinion of me. I can, however, change what influences your opinion." - David Crow
|
|
|
|
|
I did...
I don't get confirmation of replys or attachments...
shotgun
|
|
|
|
|
Hello,
I have a Lib which has some objects which are compiled depending on whether certain macros are defined or not. I was wondering if it is possible to have multiple builds of the Lib for the different scenarios and have Visual C++ automatically choose between the correct version of the Lib to use?
Example:
In the Lib:
#ifdef _MACROA
class A
{
.
:
.
};
#endif // defined(_MACROA)
This means that we have two possible versions of the Lib: one for when _MACROA is defined and another for when it's not.
So the question is how to configure the project settings in the (implementation) App - if such a thing is possible at all - to make it choose the correct version of the Lib depending on whether the macro is defined or not.
Perhaps I should adopt a different strategy?
All insights on the question in hand will be greatly appreciated.
David
|
|
|
|
|
You could use a method such as:
#ifdef _DEBUG
#pragma comment(lib,"SomeLibrary_D.lib") <font color=green>// Use debug build of library</font>
#else
#pragma comment(lib,"SomeLibrary.lib") <font color=green>// Use release build of library</font>
#endif
Depending on which build of your program you will be using, these #pragma definitions will use the corresponding build of the dependent dll.
I Dream of Absolute Zero
|
|
|
|
|
You could also always add a new 'configuration'.
The 2 defaults are Win32 Release and Win32 Debug, but you can add others, which allows you to define specific project settings for each one. You can create different output files, use different preprocessor macros, include different libraries, etc.
You you could have
Win32 Release With MacroA
Win32 Release No MacroA
Win32 Debug With MAcroA
Win32 Debug No MAcroA
for example.
On the VC 6.0 'Build' menu there is an item labeled 'Configurations...' that invokes a dialog that allows you to add/remove configurations.
Then, when you want to work on a specific configuration, you use the Build|Set Active Configuraiton... menu item to specifically define the one you are working on.
You can use Build|Batch Build... menu item to make all of them at once.
|
|
|
|
|
Great! That's exactly what I was looking for!
Thank you very much for replying.
David
|
|
|
|
|
You are welcome, glad the information helped.
It is a handy feature to make custom builds of your software for different customers or target audiances.
|
|
|
|
|
Hi
I want to merge several files into one file. How can i do this in Visual C++
In DOS it is very easy, you just use the copy function in a batch file, e.g copy "c:\tstTag3.csv" + "c:\tstTag4.csv" "c:\test.HTML"
Can anyone help me get started with this?
Thanks
Gunnar
|
|
|
|
|
You use the file commands: CreateFile, ReadFile, WriteFile, and CloseHandle functions. The first call creates the output file and opens the first input file. When you are done reading the first input file, close its handle and open the next one. Open each subsequent input file for reading and keep writing to the output file. Close the output file when you are done reading the input files.
|
|
|
|
|
On days like this I feel like a total n00b, even after three years of intensivly using MFC... do a good deed today and help me... pleeeease!
I do have Visual Studio .NET 2003 and plan to make a multi document application with several different views for each document so I can switch on-the-fly between those different views with some buttons on the toolbar.
For achieving this I used the project wizard to generate a multi document Doc/View application with the view derived from CView. So far so good. Now I inserted a new MFC class derived from CFormView and I enabled the checkbox "Create DocTemplate ressources". Afterwards I had a new class, a new dialog in the ressources and in the applications InitInstance() I got this:
CMultiDocTemplate* pNewDocTemplate = new CMultiDocTemplate(
IDR_SOMEFORMVIEW_TMPL,
RUNTIME_CLASS(CTestMultiViewsDoc),
RUNTIME_CLASS(CChildFrame),
RUNTIME_CLASS(CSomeFormView));
AddDocTemplate(pNewDocTemplate);
When I start my application now I get the following window:
(image link)
Question 1: how do I circumvent this dialog and preselect one of those views?
Question 2: how do I switch between those views during runtime without closing/deleting the document?
Jup, that would be it.
I have already read this Codeproject article and this (quite old) Codeguru article but I do not get it working as I want it to work.
There must be a good and simple solution for this, because my intend isn't that special I think. So please tell me how to do it or where to read more about it.
Thanks & Bye,
Matthias / T.T.H.
|
|
|
|
|
losing the dialog in 1. involves changing the command line passed to the app in initinstance() ... cant remember exactly what but look in msdn and it'll be there
2. switching between views? u mean creating a new view or what exactly? the user switches between them with the mouse
unless u mean a different representation of the same data ... in which case ur OnDraw() handler can do that for you
"there is no spoon"
biz stuff about me
|
|
|
|
|
Concerning 1: I solved the problem another way and don't have multiple document templates now - so I don't need to preselect one of them.
Concerning 2: I want to switch through all the views by some buttons on the toolbar.
I guess I developed a solution yesterday solving my problem. I appended a (quite long) post under Jorge's articel about switching views. You can find it here.
Thanks for the help,
Matthias / T.T.H.
|
|
|
|
|
I'm not sure I understand ...
you only have the name of the file ( test.xml ) ? or the full path name ( C:\Temp\Data\test.xml ) ?
if you only have the name of the file, you need to search your disk to find the file ( FindFirstFile an d FindNextFile, and recurse all folders ).
if you already have the full path, only extract the string up to the last backslash.
Maximilien Lincourt
Your Head A Splode - Strong Bad
|
|
|
|
|
Hi All,
I've got an application which I based on the StillCap demo that comes with the DirectX SDK.
I wrote and tested the software on a Windows 2000 machine but have recently tried the software on a Windows XP machine and suprise suprise the software no longer produces the results we expect!!!
What the software does is to capture frames from the video camera as needed and the perform some processing on the image and then save the image to a RAW file. On the XP machine the saved images color don't save right and there is also a slight 'border' on the left hand side of the image (on the 2000 machine the images are perfect).
I think I've managed to locate a potential cause of the problem, on the 2000 machine the size of the image array in the windows callback is 233472 whereas on the XP machine it is only 230400. Thats a total of 3072 difference which I *think* is the image header, i.e. 1024 * 3 (for RGB).
Does anyone have any ideas on this and how I can fix it.
cheers,
|
|
|
|
|
I think I've now got round this feature by interrorgating the O/S, if its XP then I 'add' the extra bits onto the buffer, this then produces the output file correctly.
I know this is not ideal and would appreciate if someone could still answer this question.
cheers,
Andy
|
|
|
|
|
Hi
In my application i want to change volume control of Main speaker,WaveIn,etc. Is there any simple way to do this. If yes can i get some sample code.
Thanks
JP
ALL THINGS ARE POSSIBLE UNTIL THEY ARE PROVED IMPOSSIBLE-AND EVEN THE IMPOSSIBLE MAY ONLY BE SO,AS OF NOW
|
|
|
|
|
See if this article gets you started.
"Opinions are neither right nor wrong. I cannot change your opinion of me. I can, however, change what influences your opinion." - David Crow
|
|
|
|
|
Thanks for ur reply . it is very helpful for me. one general question. How can i change the volume of wavein device(mic)?
Thanks
JP
ALL THINGS ARE POSSIBLE UNTIL THEY ARE PROVED IMPOSSIBLE-AND EVEN THE IMPOSSIBLE MAY ONLY BE SO,AS OF NOW
|
|
|
|
|
P_JAYAPRAKASH wrote:
How can i change the volume of wavein device(mic)?
How about waveOutSetVolume()?
"Opinions are neither right nor wrong. I cannot change your opinion of me. I can, however, change what influences your opinion." - David Crow
|
|
|
|
|
I think WaveOutVolume is for "WaveOut" devices not for wavein.
ALL THINGS ARE POSSIBLE UNTIL THEY ARE PROVED IMPOSSIBLE-AND EVEN THE IMPOSSIBLE MAY ONLY BE SO,AS OF NOW
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
