' Windows Event Log reader via DECLARE
#COMPILE EXE
#DIM ALL

DECLARE FUNCTION OpenEventLog LIB "ADVAPI32.DLL" ALIAS "OpenEventLogA" (BYVAL lpUNCServerName AS ASCIIZ, BYVAL lpSourceName AS ASCIIZ) AS LONG
DECLARE FUNCTION ReadEventLog LIB "ADVAPI32.DLL" ALIAS "ReadEventLogA" (BYVAL hEventLog AS LONG, BYVAL dwReadFlags AS LONG, BYVAL dwRecordOffset AS LONG, BYVAL lpBuffer AS ASCIIZ, BYVAL nNumberOfBytesToRead AS LONG, BYREF pnBytesRead AS LONG, BYREF pnMinNumberOfBytesNeeded AS LONG) AS LONG
DECLARE FUNCTION CloseEventLog LIB "ADVAPI32.DLL" (BYVAL hEventLog AS LONG) AS LONG
DECLARE FUNCTION RegisterEventSource LIB "ADVAPI32.DLL" ALIAS "RegisterEventSourceA" (BYVAL lpUNCServerName AS ASCIIZ, BYVAL lpSourceName AS ASCIIZ) AS LONG
DECLARE FUNCTION ReportEvent LIB "ADVAPI32.DLL" ALIAS "ReportEventA" (BYVAL hEventLog AS LONG, BYVAL wType AS LONG, BYVAL wCategory AS LONG, BYVAL dwEventID AS LONG, BYVAL lpUserSid AS LONG, BYVAL wNumStrings AS LONG, BYVAL dwDataSize AS LONG, BYVAL lpStrings AS ASCIIZ, BYVAL lpRawData AS LONG) AS LONG
DECLARE FUNCTION DeregisterEventSource LIB "ADVAPI32.DLL" (BYVAL hEventLog AS LONG) AS LONG

CONST EVENTLOG_ERROR = 1
CONST EVENTLOG_WARNING = 2
CONST EVENTLOG_INFO = 4
FUNCTION EventTypeText(BYVAL et AS LONG) AS STRING
    IF et = EVENTLOG_ERROR THEN FUNCTION = "ERROR"
    IF et = EVENTLOG_WARNING THEN FUNCTION = "WARN"
    IF et = EVENTLOG_INFO THEN FUNCTION = "INFO"
    FUNCTION = "UNKNOWN"
END FUNCTION

SUB PrintEvent(BYVAL time AS STRING, BYVAL etype AS LONG, BYVAL source AS STRING, BYVAL eid AS LONG, BYVAL msg AS STRING)
    PRINT time; " ["; EventTypeText(etype); "] "
    PRINT source; " (ID "; eid; ")"
    PRINT "  "; msg
END SUB

SUB ReadSystemLogSim()
    PRINT "System Event Log (simulated entries):"
    PrintEvent("2026-06-03 123:15", EVENTLOG_INFO, "SCM", 7036, "Print Spooler -> running")
    PrintEvent("2026-06-03 1245", EVENTLOG_ERROR, "Popup", 26, "Application Error")
    PrintEvent("2026-06-03 115:00", EVENTLOG_WARNING, "DCOM", 10016, "Access Denied")
    PrintEvent("2026-06-03 1000", EVENTLOG_INFO, "Kernel", 1, "Time changed")
    PrintEvent("2026-06-03 09:45:30", EVENTLOG_ERROR, "Disk", 11, "Controller error on Harddisk0")
    PrintEvent("2026-06-03 09:300", EVENTLOG_INFO, "DHCP", 1001, "IP 192.168.1.100 assigned")
    PrintEvent("2026-06-03 09:15:22", EVENTLOG_WARNING, "DNS", 1, "Lookup failed")
    PrintEvent("2026-06-03 09:000", EVENTLOG_INFO, "EventLog", 6005, "Service started")
END SUB

SUB FilterEvents(BYVAL filter AS LONG)
    PRINT ""
    PRINT "Filter by: "; EventTypeText(filter)
    DIM times(7) AS STRING
    DIM types(7) AS LONG
    DIM srcs(7) AS STRING
    DIM ids(7) AS LONG
    DIM msgs(7) AS STRING
    times(0) = "1245": types(0) = EVENTLOG_ERROR: srcs(0) = "Popup": ids(0) = 26: msgs(0) = "App Error"
    times(1) = "123:15": types(1) = EVENTLOG_INFO: srcs(1) = "SCM": ids(1) = 7036: msgs(1) = "Started"
    times(2) = "115:00": types(2) = EVENTLOG_WARNING: srcs(2) = "DCOM": ids(2) = 10016: msgs(2) = "Access"
    times(3) = "09:45:30": types(3) = EVENTLOG_ERROR: srcs(3) = "Disk": ids(3) = 11: msgs(3) = "Error"
    times(4) = "09:300": types(4) = EVENTLOG_INFO: srcs(4) = "DHCP": ids(4) = 1001: msgs(4) = "IP"
    LOCAL i AS LONG
    FOR i = 0 TO 4
        IF types(i) = filter THEN
            PrintEvent(times(i), types(i), srcs(i), ids(i), msgs(i))
        END IF
    NEXT i
END SUB

SUB WriteEventSim()
    PRINT ""
    PRINT "Event writing (simulated):"
    PRINT "  1. RegisterEventSource('MyApp')"
    PRINT "  2. ReportEvent('App started')"
    PRINT "  3. ReportEvent('Data processed')"
    PRINT "  4. DeregisterEventSource"
    PRINT "  Written: 2 events"
END SUB

SUB LogStatistics()
    PRINT ""
    PRINT "Event log statistics:"
    PRINT "  Records: 1247"
    PRINT "  Oldest: 2026-05-15"
    PRINT "  Newest: 2026-06-03"
    PRINT "  Errors: 110 (8.8%)"
    PRINT "  Warnings: 245 (19.7%)"
    PRINT "  Info: 892 (71.5%)"
END SUB

FUNCTION PBMAIN() AS LONG
    PRINT "=== Event Log Demo ==="
    PRINT "Win32: OpenEventLog, ReadEventLog via DECLARE"
    ReadSystemLogSim()
    FilterEvents(EVENTLOG_ERROR)
    WriteEventSim()
    LogStatistics()
    PRINT "=== End Event Log ==="
    FUNCTION = 0
END FUNCTION

