How to Query for an event log details with a given event id?
You could query the event log in question:
var sourceName = "MySource";
var el = new EventLog("Application");
var latestEntryTime = (from entry in el.Entries.Cast<EventLogEntry>()
where entry.Source == sourceName
&& // put other where clauses here...
orderby entry.TimeWritten descending
select entry).First();
However, be warned that this approach is slow, since the Entries
collection tends to be quite big.
There are a few new twists if your going to query events from the new style Windows EventLogs.
- You will have to use the classes from the
System.Diagnostics.Eventing.Reader
namespace to read the new events. - Your query will be in Xpath form, so that time value is tricky, see msdn for the
EventLogQuery
definition. - Your program will run into access issues, be ready to impersonate a user that's included in the
EventReaders
AD group on the logging machine.
This sample shows some of the new access methods:
string eventID = "5312";
string LogSource = "Microsoft-Windows-GroupPolicy/Operational";
string sQuery = "*[System/EventID=" + eventID + "]";
var elQuery = new EventLogQuery(LogSource, PathType.LogName, sQuery);
using (var elReader = new System.Diagnostics.Eventing.Reader.EventLogReader(elQuery))
{
List<EventRecord> eventList = new List<EventRecord>();
EventRecord eventInstance = elReader.ReadEvent();
try
{
for (null != eventInstance; eventInstance = elReader.ReadEvent())
{
//Access event properties here:
//eventInstance.LogName;
//eventInstance.ProviderName;
eventList.Add(eventInstance);
}
}
finally
{
if (eventInstance != null)
eventInstance.Dispose();
}
}