阅读事件日志从最新到最旧 [英] Read Event Log From Newest to Oldest

问题描述

我已经写了一个小程序，以建立远程电脑使用的是张贴在启动和关闭的事件日志消息的正常运行时间。目前的逻辑是：

I have written a short program to establish the uptime for remote PC's using the event log messages which are posted at startup and shutdown. Currently the logic is :

  foreach (eventlogentry)
  {
       if (entryTime > OldestTime)
       {
            if (entry = Startup)
            {
                 addOnTime(entry.Time);
            }
            if (entry = Shutdown)
            {
                 addOffTime(entry.Time);
            }
       }
  }

OldestTime定义多远向后扫描时间....

"OldestTime" define how far to scan backwards in time....

我想知道是否有反正轻松ammend我的程序读取最新到最旧的事件？

I would like to know if there is anyway to easily ammend my program to read the events from newest to oldest?

它读取远程事件日志和其采取一段时间这个功能来运行，因为它开始于年底读取迈进。

It's reading remote event logs and its taking a while for this function to run, as it starts at the end and reads forward.

我知道这是因为我增加了其他块到第一个如果打出来的的foreach块，如果时间跨度内的输入心不是我们正在寻找并在程序停止的在它读取的第一个事件。

I know this because I added a "else" block to the first "if" to break out of the foreach block, if the entry isnt within the timespan we are looking for and the program stop's at the first event it reads.

推荐答案

它已经有一段时间，你问这个问题，但我遇到同样的问题，并找到了解决办法。

It has been a while since you asked this question, but i ran into the same problem and found a solution.

using System.Diagnostics;
using System.Linq;

EventLog events = new EventLog("Application", System.Environment.MachineName);
foreach (EventLogEntry entry in  events.Entries.Cast<EventLogEntry>().Reverse())
{
    //Do your tasks
}

这awnser还不是一样快，只是列举它向前，但它比使用循环项目复制到更优雅一点列表。

This awnser still is not as fast as to just enumerate it forward but it is a bit more elegant than using a loop to copy items to a list.

@ leinad13，为您的应用程序，你需要System.Environment.MachineName更改为字符串的计算机的名称你想从和更改事件应用程序您要查看日志。我认为，系统，在你的情况。

@leinad13, for your application you need to change System.Environment.MachineName to a string with the name of the computer you want the events from and change "Application" to the log you want to see. I think "System" in your case.

这篇关于阅读事件日志从最新到最旧的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！