如何将 Windows 事件日志刷新到磁盘？

Question

I have a Windows 7 embedded device which is frequently power cycled like this: a local application writes an entry to the Application event log and a few seconds later it commands the custom power supply to cycle power. A clean Windows shutdown cannot be done. After the device boots back up, I check the Windows event log and notice the last entry missing.

Is there some way to flush the Windows event log to disk so that I don't miss that last entry? The application is written in C++.

Thanks, Adnan

Answer 1

You have a hardware problem so the best solution is to resolve it in hardware. But moving on.

Use BIOS to ensure computer always starts after a power cycle

You have a hardware tool to perform the reboot. Could you reconfigure that so that rather than doing a hard power cycle while the computer is running, you:

• notify the hardware power cycle tool,
• perform an orderly shutdown, then
• power the computer on again using the hardware power switch?

There is usually a bios setting which allows you to specify the action after a power cycle, eg

• Leave the computer off,
• Turn it on,
• Turn it on only if it was on when power was lost.

If you can do this, then you can still do an orderly shutdown and wait for that to complete before powering on again.

Software Solution: Turn off disk write caching

It's not exactly clear what is causing your issue, but the following seem relevant.

Most likely, this is a result of disk write caching either by the disc controller hardware, or by the operating system.

You may be able to turn this off through the Disk Management tool:

• http://www.thewindowsclub.com/enable-disable-disk-write-caching-windows-7-8

Software Solution: Flush the disk programmatically

Alternatively, you may be able to flush the disk cache programmatically. This tool may help:

• https://superuser.com/questions/833552/manually-flushing-write-cache-on-window

Or indeed with WMI and PowerShell:

• https://technet.microsoft.com/en-us/library/dn454975.aspx