How to Read and Write Entries in an Event Log in C#?

Event logs are the files used by Microsoft Windows to store the details of important events, such as a user starting a file transfer, and the details of resource problems, such as memory allocation failure. You can use the information in event logs to determine the cause of critical events.

Windows maintains three event logs by default: System Event Log, Security Event Log, and Application Event Log.

• System event log logs information which is taking place on system-level hardware and the hardware within your machine.
• Security event log is used to log security level events.
• Application Log is typically used to store information and activities that are occurring for registered applications.

In addition the above three default event logs, you can also create your own custom logs to be able to write to from your application.

Each entry in an event log provides details about an event that has occurred. These details include:

• Event ID
• Date and time of the event
• Name of the user logged on when the event occurred
• Name of the computer where the event occurred
• Source of the event
• Type of the event

In the .Net Framework, you use the EventLog class to read entries from existing logs and write entries to logs programmatically. The following code sample shows how to write entries to an event log. In this code, first you check if the event source named MySourceName already exists. If this source does not already exist, you create a new event source.

using System;
using System.Diagnostics;
class WriteEventLog
{
    public static void Main()
    {
        WriteCustomEvent("MySourceName"
            , "MyLogName"
            , string.Format("An error happened in MySourceName at {0}",DateTime.Now)
            , EventLogEntryType.Error);
    }

    public static void WriteCustomEvent(string LogSource
        , string LogName
        , string Message
        , EventLogEntryType LogEntryType)
    {
        // Create an EventLog instance and assign its source.
        EventLog logger = new EventLog();
        // Source cannot already exist before creating the log.
        if (!(EventLog.SourceExists(LogSource)))
        {
            // Logs and Sources are created as a pair.
            EventLog.CreateEventSource(LogSource, LogName);
            // Associate the EventLog component with the new log.
            logger.Log = LogName;
            logger.Source = LogSource;
        }
        else
        {
            logger.Source = LogSource;
        }
        // Write an entry to the event log.
        logger.WriteEntry(Message, EventLogEntryType.Warning);
        foreach (EventLogEntry entry in logger.Entries)
        {
            //Fetch information from the ClassLogs event log
            //and display the information on the console.
            Console.WriteLine("\tEntry: " + entry.Message);
        }
        Console.ReadLine();
    }
}