Trying to get an Eventlog file to be copied to another folder for backup purpose

Question

I try to copy the EventLog "Application" to another folder on my PC but always get the error that

"....Could not find a part of the path 'C:\Windows\System32\winevt\Logs\Application.evtx..."

I use the code:

public void collectEventLogsFromSystem(string RequestedlogName,string newFolderPath)
{
    string combinedLogToFind =      "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Eventlog\\" + RequestedlogName;
    string LogEventsPath = (string)Registry.GetValue(combinedLogToFind, "File", null);
    if (LogEventsPath != null)
    {
        System.IO.File.Copy(LogEventsPath, newFolderPath +"\\"+ RequestedlogName, true);               
    }

}//collectEventLogsFromSystem method

Even if i use explicit folder path it won't work:

System.IO.File.Copy(@"C:\Windows\System32\winevt\Logs\Application.evtx", "c:\\ttt\\Application.evtx", true);

any idea?

Answer 1

I found this answer on StackOverflow which will probably solve your problem. I have a 64 bit machine which exhibited the same behavior. This post by John Rasch solved the issue and explains why it failed.

Answer 2

If you are trying to get the log file while the program is running, the way above will not work. This post Export Event Log (.evtx) without "run as administrator" will allow you to backup the event log, even if you are currently using the event log in your application.