Take the 2-minute tour ×

1) How to know whether a particular event (given event ID, time and node as inputs) is logged or not? [In this case, I know only one event will be logged]

2) If the event is logged, how do I get details like event description, Log-name etc..

for eg, I want to query for an event under the node Applications and Services Logs > Microsoft > Windows > groupPolicy > Operational, and event id is 5315 and time is current time.

share|improve this question

2 Answers 2

up vote 10 down vote accepted

There are a few new twists if your going to query events from the new style Windows EventLogs.

  1. You will have to use the classes from the System.Diagnostics.Eventing.Reader namespace to read the new events.
  2. Your query will be in Xpath form, so that timerage is tricky, see msdn for the EventLogQuery definition.
  3. Your program will run into access issues, be ready to impersonate a user thats included in the EventReaders AD group on the logging machine.

This sample shows some of the new access methods, cheers.

        string eventID = "5312";
        string LogSource = "Microsoft-Windows-GroupPolicy/Operational";  
        string sQuery = "*[System/EventID=" + eventID + "]";

        var elQuery = new EventLogQuery(LogSource, PathType.LogName, sQuery);
        var elReader = new System.Diagnostics.Eventing.Reader.EventLogReader(elQuery);

        List<EventRecord> eventList = new List<EventRecord>();
        for (EventRecord eventInstance = elReader.ReadEvent();
            null != eventInstance; eventInstance = elReader.ReadEvent())
            //Access event properties here:
share|improve this answer
Thanks Kellie.. It helped –  satya Mar 18 '10 at 13:08
how about getting event withing given dates? query = "*[System[" + "(Provider/@Name=\"Microsoft Office 15 Alerts\") and " + //"(EventID=300) and " + "(TimeCreated/@SystemTime &gt;= \"" + t1 + "\") and " + "(TimeCreated/@SystemTime &lt;= \"" + t2 + "\")" + "]]"; I am getting query exception –  Sun_Sparxz Jan 16 at 17:15

You could query the event log in question:

var sourceName = "MySource";
var el = new EventLog("Application");
var latestEntryTime = (from entry in el.Entries.Cast<EventLogEntry>()
                       where entry.Source == sourceName
                       && // put other where clauses here...
                       orderby entry.TimeWritten descending
                       select entry).First();

However, be warned that this approach is slow, since the Entries collection tends to be quite big.

share|improve this answer

Your Answer


