Read event log in C#

Question

I'm trying to read event logs for my application EventLoggingApp. The problem is reading logs for my single source (EventLoggingApp).

This code read logs for every source. What is the problem? Any advice?

static void ReadEvenLog()
{
    string eventLogName = "Application";
    string sourceName = "EventLoggingApp";
    string machineName = "Tom";

    EventLog eventLog = new EventLog();
    eventLog.Log = eventLogName;
    eventLog.Source = sourceName;
    eventLog.MachineName = machineName;

    foreach (EventLogEntry log in eventLog.Entries)
    {
        Console.WriteLine("{0}\n",log.Source);
    }
}

score 31 · Answer 1 · edited Sep 19 '17 at 14:40

31

Try this:

EventLog log = new EventLog("Security");
var entries = log.Entries.Cast<EventLogEntry>()
                         .Where(x => x.InstanceId == 4624)
                         .Select(x => new
                         {
                             x.MachineName,
                             x.Site,
                             x.Source,
                             x.Message
                         }).ToList();

edited Sep 19 '17 at 14:40

martijnn2008

3,552
5
30
40

answered Jul 07 '16 at 11:11

Domenico

309
3
6

2

An explanation as to what's achieved by this code snippet would be nice... – Rodolfo G. Mar 27 '18 at 23:35
@Domenico can you explain how do you get the InstanceId? Would be very helpfull? Thx! – Darem May 30 '18 at 11:36
@Darem i found this in Evend ID column of Security Windows Registry – Domenico Oct 18 '18 at 09:30
1

Error: System.Security.SecurityException: 'Requested registry access is not allowed.' – anhtv13 Aug 15 '19 at 09:48
@anhtv13 may the user you're using is not allowed to read the registry – Domenico Sep 17 '22 at 06:07
This code must be run as admin. – andrew.fox Jun 28 '23 at 06:01

Vyacheslav Antonyuk · Answer 2 · 2016-11-29T16:59:30.320

5

Check out this article on MSDN. You can't read event log entries by source. Only log name matters. Instead you can create separate event log for you application or filter entries by verifying Source property of each entry in foreach loop.

edited Nov 29 '16 at 16:59

answered Jun 30 '10 at 09:48

Vyacheslav Antonyuk

119
5

2

Thx, I am from Slovakia, your eng is much more better than my :) – Tom159 Jun 30 '10 at 11:10

score 1 · Answer 3 · answered Jun 30 '10 at 09:49

MSDN (1)(2) says that Source is for writing event logs only.

It is not necessary to specify a Source when only reading from a log. You can specify only the Log name and MachineName (server computer name) properties for the EventLog instance. In either case, the Entries member is automatically populated with the event log's list of entries. You can select the appropriate index for an item in this list to read individual entries. (1)

score 0 · Answer 4 · answered Feb 27 '13 at 19:23

0

I am not really sure what you were trying to print on the console. If it is the message in each event log entry that you are trying to print, inside the foreach loop you should have this instead:

Console.WriteLine(log.Message + "\n");

answered Feb 27 '13 at 19:23

Tanvir

1,453
2
16
32

score -1 · Answer 5 · answered Jun 30 '10 at 09:36

-1

If you connect to localhost set MachineName to "." Check if user has right to read from eventlog

answered Jun 30 '10 at 09:36

Aik

3,528
3
19
20

1

Since he gets ALL logs from his machine, there are no security problems. – atamanroman Jun 30 '10 at 09:50

Read event log in C#

5 Answers5

Linked