How to Query for an event log details with a given event id?

You could query the event log in question:

var sourceName = "MySource";
var el = new EventLog("Application");
var latestEntryTime = (from entry in el.Entries.Cast<EventLogEntry>()
                       where entry.Source == sourceName
                       && // put other where clauses here...
                       orderby entry.TimeWritten descending
                       select entry).First();

However, be warned that this approach is slow, since the Entries collection tends to be quite big.


There are a few new twists if your going to query events from the new style Windows EventLogs.

  1. You will have to use the classes from the System.Diagnostics.Eventing.Reader namespace to read the new events.
  2. Your query will be in Xpath form, so that time value is tricky, see msdn for the EventLogQuery definition.
  3. Your program will run into access issues, be ready to impersonate a user that's included in the EventReaders AD group on the logging machine.

This sample shows some of the new access methods:

string eventID = "5312";
string LogSource = "Microsoft-Windows-GroupPolicy/Operational";  
string sQuery = "*[System/EventID=" + eventID + "]";

var elQuery = new EventLogQuery(LogSource, PathType.LogName, sQuery);
using (var elReader = new System.Diagnostics.Eventing.Reader.EventLogReader(elQuery))
{

    List<EventRecord> eventList = new List<EventRecord>();
    EventRecord eventInstance = elReader.ReadEvent();
    try
    {
        for (null != eventInstance; eventInstance = elReader.ReadEvent())
        {
            //Access event properties here:
            //eventInstance.LogName;
            //eventInstance.ProviderName;
            eventList.Add(eventInstance);
        }
    }
    finally
    {
        if (eventInstance != null)
            eventInstance.Dispose();
    }
}

Tags:

C#

Events