EventLogReader filter EventLogQuery by created TimeDate

Question

My current problem is, that I don't know the syntax of those Eventlogqueries. I want a query that gives me all the Events of the past one Week

 private Result<List<AssetManagementEventlogDTO>> GetEvents()
    {
        var eventList = new List<AssetManagementEventlogDTO>();
        string queryString = " *";
        SecureString pw = new SecureString();
        foreach (char c in Password)
        {
            pw.AppendChar(c);
        }
        EventLogSession session = new EventLogSession(
            IP,                               // Remote Computer
            Domain,                                  // Domain
            Username,                                // Username
            pw,
            SessionAuthentication.Default);

        EventLogQuery query = new EventLogQuery("Security", PathType.FilePath, queryString);
        query.Session = session;
        GetEventlog(query, eventList, AssetManagementEventlogType.Security);
        query = new EventLogQuery("Application", PathType.FilePath, queryString);
        query.Session = session;
        GetEventlog(query, eventList, AssetManagementEventlogType.Application);
        query = new EventLogQuery("System", PathType.FilePath, queryString);
        query.Session = session;
        GetEventlog(query, eventList, AssetManagementEventlogType.System);
        return Result<List<AssetManagementEventlogDTO>>.AsSuccess(eventList);
    }

score 2 · Accepted Answer · answered Jan 12 '17 at 08:33

2

Ok I got the syntax now how it's working:

        var daysAgo7 = DateTime.Now.AddDays(-7);
        string queryString = $"*[System/TimeCreated/@SystemTime >= '{daysAgo7.ToString("yyyy-MM-dd")}T00:00:00.000000000K']";

answered Jan 12 '17 at 08:33

Sokui

53
1
10

EventLogReader filter EventLogQuery by created TimeDate

1 Answers1