阅读事件查看器条目 [英] Read event viewer entries

问题描述

我想在 c# 程序中从某个自定义事件日志中读取事件条目，并通过他们的描述过滤它们.有没有办法做到这一点?还是一种将条目作为集合获取的方法，以便我可以按条件从中进行选择?

I want to read event entries from a certain custom event log at c# program, And to filter them by their description. Is there a way to do it? Or a way to get the entries as collection so I will be able to select from that by condition?

推荐答案

试试这样的:

       string queryString = string.Format("*[System[TimeCreated[@SystemTime>='{0}' and @SystemTime<='{1}']]]",
            DateTime.Now.Date.AddDays(-10).ToString("s"),
            DateTime.Now.Date.ToString("s"));
        var q = new EventLogQuery("Microsoft-Windows-User Profile Service/Operational", PathType.LogName, queryString);
        var r = new EventLogReader(q);

        var list = new List<EventRecord>(); 

        EventRecord er = r.ReadEvent();
        while (er != null) {
            list.Add(er);
            er = r.ReadEvent();
        }

过滤器是XPath 和XQuery.如果你想了解事件的内部结构，我发现最好通读 eventvwr 中的过滤器定义.查看 XML-tab...

The filter is XPath and XQuery. If you want to learn about an events internal structure I found it best to read through the filter definition within eventvwr. Look into the XML-tab...

这篇关于阅读事件查看器条目的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！