Windows Event Logs

Events Logs provide a standard location where events and other messages can be recorded and later reviewed using applications such as the Event Viewer. The .NET Framework Class Library also includes several classes that may be used to create Event Logs, read from or write events to these logs, and delete Event Logs.

Three default Event Logs (Application, Security, and System) cannot be deleted. (The Security log is read-only and cannot be written to directly.) Additional resources or applications may also create their own Event Logs, such as the Domain Name System (DNS) or the Active Directory. It is important to never use the Delete method on any of these logs, because deleting a log also removes all event sources registered with the deleted Event Log.

Table 14.3 details some useful members of the EventLog class within the System.Diagnostics namespace.

Table 14.3. Useful Members of the EventLog Class

Member	Type	Description
CreateEventSource	Method	Opens an event source for an application
Delete	Method	Removes a log resource
DeleteEventSource	Method	Removes an application's event source from a log
EnableRaisingEvents	Property	Specifies whether the EventLog object is notified upon the EntryWritten event
Entries	Property	The contents of a log
EntryWritten	Event	Fires when an entry is written to an Event Log on the local computer
Exists	Method	Indicates whether the specified log exists
GetEventLogs	Method	Returns an array of all Event Logs on the local computer
Log	Property	The name of the log to read from or write to
LogDisplayName	Property	An Event Log's user -friendly name
LogNameFromSourceName	Method	The name of the log to which a specified source is registered
MachineName	Property	The name of the computer on which to read or write events
Source	Property	The event source to register and use when writing to the Event Log
SourceExists	Method	Determines whether a given event source exists
WriteEntry	Method	Writes an entry to the log

Each application must register an event source before it can interact with an Event Log. You only need to register a source once. Registration information is stored in the Registry, so even if you stop and restart your application, it remains registered. The CreateEventSource method can be used to register the application with an Event Log, creating the log if it does not yet exist.

The WriteEntry method of the EventLog class is used to write messages into the Event Log specified by the event source. If the event source has not already been created using the CreateEventSource method, it will be created automatically by the WriteEntry method. The type of event written is determined by its EventLogEntryType enumerated value (Error, FailureAudit, Information, SuccessAudit, or Warning).

To experiment with writing information to an Event Log, follow these steps:

1. Create a new Visual Basic .NET Windows Application project.

2. Rename the default form in the application WriteEvents.vb . Set this form as the startup form for the application.

3. Add a TextBox control named txtEvent and a CommandButton control named cmdSave to the form.

4. Switch to code view and add the following code at the top of the form's module:

    Imports System.Diagnostics 

5. Add this code to run when you click the button:

    Private Sub cmdSave_Click(ByVal sender As System.Object, _  ByVal e As System.EventArgs) Handles cmdSave.Click     Dim el As EventLog = New EventLog("Application")     el.WriteEntry("WriteEvent", txtEvent.Text, _      EventLogEntryType.Information, 1) End Sub 

6. Run the application. Enter some text in the text box and click the Save button.

7. Open the Event Viewer on your computer by selecting Start, Programs, Administrative Tools, Event Viewer. Select the Application Log and you should see the event that you just created. Double-click the event to see its details, as shown in Figure 14.2.

   Figure 14.2. Details of a newly created event.

   

Accessing Event Logs

To access the contents of an Event Log, you will use the Entries property of the EventLog object to return an EventLogEntryCollection object. The elements of this object are the individual Event Log entries. It is possible to use these objects to read events on the local system as well as those from remote systems.

Although you can read Event Logs on remote systems, the EntryWritten event can only be used to fire when Event Log entries are written on the local system.

When referring to the local system, you may use a single dot ( . ). Adding an evaluation to see whether the application is accessing an Event Log on the local system may be accomplished using code similar to this:

 If (txtMachineName.Text = _  SystemInformation.ComputerName) Or _  (txtMachineName.Text = ".") Then     <do something> Else     <do something else> End If 

To practice viewing the contents of an Event Log, follow these steps:

1. Add a new form to the Visual Basic .NET application you created in the previous set of steps. Name the new form ReadEvents.vb .

2. Place a TextBox control named txtEvent on the new form.

3. Add this code to the existing WriteEvents.vb form:

    Private Sub Form1_Load(ByVal sender As System.Object, _  ByVal e As System.EventArgs) Handles MyBase.Load     Dim f As New ReadEvents()     f.Show() End Sub 

4. Add this code to the new ReadEvents.vb form:

    Dim WithEvents el As EventLog Private Sub ReadEvents_Load(ByVal sender As System.Object, _  ByVal e As System.EventArgs) Handles MyBase.Load     el = New EventLog("Application")     el.EnableRaisingEvents = True End Sub Private Sub el_EntryWritten(ByVal sender As Object, _  ByVal e As System.Diagnostics.EntryWrittenEventArgs) _  Handles el.EntryWritten     txtEvent.Text = e.Entry.Message End Sub 

5. Run the application. Enter some text on the WriteEntry form and click the Save button. You'll see the text appear on the ReadEntry form after the event is saved.