EventLogSession.ExportLogAndMessages()引发EventLogException w/message目录名称无效 [英] EventLogSession.ExportLogAndMessages() throws EventLogException w/ message The directory name is invalid

问题描述

问候，

我想知道我是否在.NET中遇到错误.我正在使用ExportLogAndMessages()方法.当我调试代码时，它在此行以EventLogException中断，并显示消息目录名称无效".我认为是 抱怨我为.evtx文件指定的文件路径，我需要创建它.事实是它确实会生成.evtx文件，并且看起来是有效且完整的.

I'm wondering if I've encountered a bug in .NET.  I'm using the ExportLogAndMessages() method.  When I debug my code, it breaks at this line with an EventLogException with the message "The directory name is invalid".  I assume it's complaining about the file path I've specified for the .evtx file I need it to create.  The thing is that it actually does generate the .evtx file and it appears to be valid and complete.

我没有以管理员权限运行程序.我当然可以处理该异常，但是我想知道这是否是MS需要检查的错误.

I am not running my program with admin privileges.  I can certainly just handle the exception, but I'm wondering if this is a bug that needs to be looked at by MS.

这是我的源代码:

static int Main(string[] args)
        {
            DateTime dtObject;
            string beginTime,
                   endTime,
                   hostName,
                   eventLogFileName;

            beginTime = string.Empty;
            EventLog[] eLogs = EventLog.GetEventLogs();
            foreach (EventLog e in eLogs)
            {
                if (e.LogDisplayName == "Application")
                {
                    foreach (EventLogEntry entry in e.Entries)
                    {
                        dtObject = entry.TimeGenerated;
                        beginTime = getTimeStamp(dtObject);
                        break;
                    }
                    break;
                }
            }

            hostName = Environment.GetEnvironmentVariable("COMPUTERNAME");
            EventLogSession logSession = new EventLogSession();
            endTime = getTimeStamp(DateTime.Now);
            eventLogFileName = Path.Combine(exportSecurityLog.Properties.Settings.Default.logPath,hostName + "_ApplicationLog_" + beginTime + "_to_" + endTime + ".evtx");

            if (File.Exists(eventLogFileName))
                return 1;

            logSession.ExportLogAndMessages("Application", PathType.LogName, "*", eventLogFileName);
            return 0;
        }

        static string getTimeStamp(DateTime firstEntryTime)
        {
            string date,
                   time;
            string militaryTime = string.Empty;

            string[] hms;

            date = firstEntryTime.ToShortDateString().Replace('/', '-');
            time = firstEntryTime.ToLongTimeString();
            if (time.IndexOf("PM") != -1)
            {
                int hours;

                hms = time.Split(':');
                hours = Convert.ToInt16(hms[0]);
                hours += 12;
                hms[0] = hours.ToString();

            }
            else
            {
                hms = time.Split(':');
                if (hms[0].Length == 1)
                    hms[0] = "0" + hms[0];
            }

            militaryTime = (hms[0] + hms[1] + hms[2]).Split(' ')[0];
            return date + "_" + militaryTime;
        }
    }

推荐答案

在函数中的ExportLog()之后调用.它抱怨找不到事件的本地化资源信息.

The error is thrown by EvtArchiveExportedLog() that is called after ExportLog() in the function. It's complaining that it cannot find the localization resource information for the event(s).

在大多数情况下，这都不成问题.您可以仅添加 try {...} catch(EventLogException){...} 并在ErrorCode！= 267时重新抛出(即:目录名称无效)

In most cause it's not problematic. You can just add try { ... } catch (EventLogException) { ... } and rethrow if ErrorCode != 267 (i.e.: The directory name is invalid)

这篇关于EventLogSession.ExportLogAndMessages()引发EventLogException w/message目录名称无效的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！