Working With EventViewer Using C# For Beginners

// Create an EventLog instance and assign its source.
EventLog eventLog =new EventLog();
eventLog.Source ="NewSource";
// Write an entry in the event log.
eventLog.WriteEntry("This is a warning generated by the application.", EventLogEntryType.Warning, 1001);

Every event type has a different icon. In the above we create it as a warning.

But here this has just created an entry that is visible under "WindowsLog" -> "System". But this certainly should not be a part of it otherwise we may encouther difficulties while finding the events that are specific to our application. So we should create a separate group for our application and all the events should be part of that.

Creating an Entry in a new Event Log

We need to create a new source and new log name. Then use this log for creating the entries. So let's jump to write the code.

// Create the source and log, if it does not already exist.
if (!EventLog.SourceExists("MySource"))
{
    EventLog.CreateEventSource("MySource","MyNewLog");
}
// Create an EventLog instance and assign its source.
EventLog eventLog =new EventLog();
// Setting the source
eventLog.Source ="MySource";
// Write an entry to the event log.
eventLog.WriteEntry("An error has been generated by the application.", EventLogEntryType.Error, 1002);

Here if we checked if the source does exist then we created a source with the log name. Then while creating the EventLog, we provide the same source and call the write entry method. In this method, I provided the EventLogEntryType as error and the eventid that I gave is 1002. I have run the code and let's see the Event Viewer again.

Yes, a new error entry is created in a new log named MyNewLog that we provided while creating it. And here MyNewLog is created under Applications and service logs.

I have already created log entries of type error and warning. We have seen the icon is also different of these two. Similarly other types of entries can be created as well. Now let us see how to remove these from the log and even remove the log itself.

Clear the Event Log

Clearing the event log is very easy and we need to provide the source of the log to clear it. The code can be written as:

EventLog eventLog =new EventLog();
// Setting the source
eventLog.Source ="MySource";
eventLog.Clear();

Delete the Event Source

The code above removes all the entries from the log that we created in MyNewLog. Similarly we remove the source and the log itself as in the following:

if (EventLog.SourceExists("MySource"))
{
    EventLog.DeleteEventSource("MySource");
}

Delete the Log

The code above removes the source. Now to remove the log (since we created MyNewLog in this article) we can write the code as in the following:

if (EventLog.Exists("MyNewLog"))
{
    // Delete Source
    EventLog.Delete("MyNewLog");
}

Similarly, there are other options available that can be used.

Reading Event Viewer

Now we have discussed creating and edit operations. Now we will see how to read the existing logs . We might need to see the logs from the server as we might not have access to the server. So in those scenario, we can read the logs.

EventLog myLog =new EventLog();
myLog.Log ="MyNewLog";
foreach (EventLogEntry entry in myLog.Entries)
{
    // Read event log entry details
}

The code above reads all the entries from the log named MyNewLog. The entry object contains all the information of that log entry.

Hope this article will be useful to all of you.

Cheers,