The two main classes we will be working with today are the

• The EventLog Class
• The EventLogEntry Class

The EventLogEntry Class encapulates each log into the Event Log.From this we can determine the error id,the application,the machine it happened on,when it happened and much more.

The first thing we want to look at is reading from an EventLog.You can retrieve each entry from each log,or you could shorten it by providing a log name (Application, System, etc..) and the machine name to search (can be left blank or as "." for the local system).

CODE

public List <Hashtable> GetEventEntryByEvent(ref string logName,ref string machineName,ref long instanceId)
{
      try {
            List<Hashtable> events = new List<Hashtable>();
            EventLog log = new EventLog(logName, machineName);
            foreach (EventLogEntry entry in log.Entries) {
               if (entry.InstanceId == instanceId)
               {
                  Hashtable entryInfo = new Hashtable();
                  entryInfo.Add("Message",entry.Message);
                  entryInfo.Add("InstanceId",entry.InstanceId);
                  entryInfo.Add("Source",entry.Source);
                  entryInfo.Add("TimeWritten",entry.TimeWritten);
                  events.Add(entryInfo);
                  entryInfo = null;
               }
               }
            return events;
         }
         catch (Exception ex) {
            MessageBox.Show(ex.ToString());
            return null;
         }
}

In our next example we will take a look at creating a new source and log to the system's Event Log. We will then write an entry to that new source we created.

CODE

public bool AddNewEntry(ref string source,ref string logName,ref string message)
{
         try {
            if (!EventLog.SourceExists(source))
            {
               EventLog.CreateEventSource(source,logName);
               System.Threading.Thread.Sleep(3000);
               log.Source = source;
               EventLog log = new EventLog();
               log.WriteEntry(message, EventLogEntryType.Information, 99);
               return true;
         }
         catch (Exception ex) {
               MessageBox.Show(ex.ToString());
               return false;
         }
}

Now we will take a look at writing an entry to an already existing log. In this demonstration we will first check to make sure the source exists, then we will make sure the log file provided exists. If either are true we throw a new Exception and exit the function, otherwise we write the new entry

CODE

public bool WriteNewEntry(ref string source, ref string logName, ref string machineName, ref string message)
{
      try {
            EventLog log = new EventLog(logName,machineName,source);
            if (EventLog.SourceExists(source))
            {
                  if (EventLog.Exists(logName))
                  {
                     log.WriteEntry(message, EventLogEntryType.Information);
                  }
                  else
                  {
                     throw new Exception("Log name specified does not exist!");
                     return;
                  }
            }
            else
            {
                  throw new Exception("The source name provided does not
                                                   exist!");
                  return;
           }
           return true;
            catch (Exception ex) {
            {
               MessageBox.Show(ex.ToString());
               return false;
            }
}