const
    EVENTLOG_SEEK_READ = 2;
    EVENTLOG_FORWARDS_READ = 4;
type
    PEventLogRecord = ^TEventLogRecord;
    TEventLogRecord = packed record
        Length: dword;
        Reserved: dword;
        RecordNumber: dword;
        TimeGenerated: dword;
        TimeWritten: dword;
        EventID: dword;
        EventType: word;
        NumStrings: word;
        EventCategory: word;
        ReservedFlags: word;
        ClosingRecordNumber: dword;
        StringOffset: dword;
        UserSidLength: dword;
        UserSidOffset: dword;
        DataLength: dword;
        DataOffset: dword;
    end;
var
    Log: THandle;
    i: integer;
    EventCount,ByteRead,MinByteNeeded: cardinal;
    Buffer: pointer;
begin
    Log := OpenEventLog('','System');
    GetNumberOfEventLogRecords(Log,EventCount);
    GetMem(Buffer,1024);
    for i := EventCount downto 1 do begin
        if ReadEventLog(Log,EVENTLOG_SEEK_READ or EVENTLOG_FORWARDS_READ,
            i,Buffer,1024,ByteRead,MinByteNeeded) then with PEventLogRecord(Buffer)^ do
            Memo1.Lines.Add(Format('#%d ID: %d at UTC %s',[RecordNumber,EventID and $FFFF,
                DateTimeToStr(IncSecond(EncodeDate(1970,1,1),TimeGenerated))]));
    end;
    FreeMem(Buffer);
    CloseEventLog(Log);
end;