Cómo tener acceso y leer información de eventos

Cuando obtiene una instancia de eventos desde una consulta o suscripción de eventos, puede leer el valor de las propiedades de eventos. Para ello, obtenga la representación XML del evento o especifique el nombre de la propiedad que se va a leer.

Para obtener más información sobre cómo consultar eventos, vea Cómo consultar eventos. Para obtener más información sobre cómo suscribirse a eventos, vea Cómo suscribirse a eventos de un registro de eventos.

Ejemplo

Descripción

En el siguiente ejemplo de código se consultan todos los eventos de nivel 2 del registro de aplicación y, a continuación, se muestra la representación XML de cada evento. Cada instancia devuelta de la consulta de eventos se representa por una instancia de EventRecord. Se llama al método ToXml para obtener la representación XML del evento.

Código

Imports System
Imports System.Text
Imports System.Diagnostics.Eventing.Reader
Imports System.Xml

Public Class ReadEventXmlExample

    Public Overloads Shared Function Main( _
    ByVal args() As String) As Integer

        Dim logName As String = "Application"
        Dim queryString As String = "*[System/Level=2]"

        Dim eventsQuery As New EventLogQuery(logName, _
            PathType.LogName, queryString)

        Dim logReader As EventLogReader
        Console.WriteLine("Querying the Application channel event log for all events...")
        Try

            ' Query the log and create a stream of selected events
            logReader = New EventLogReader(eventsQuery)

        Catch e As EventLogNotFoundException

            Console.WriteLine("Failed to query the log!")
            Console.WriteLine(e)
            Return 1
        End Try

        Dim numberOfEvents As Integer = 0

        ' For each event returned from the query
        Dim eventInstance As EventRecord = logReader.ReadEvent()
        While Not eventInstance Is Nothing

            Dim eventXml As String = eventInstance.ToXml()
            Console.WriteLine("Event " & (++numberOfEvents) & " : " & _
                System.Environment.NewLine & eventXml)
            Console.WriteLine("---------------------------------")
            eventInstance = logReader.ReadEvent()
        End While

    End Function
End Class

using System;
using System.Text;
using System.Diagnostics.Eventing.Reader;
using System.Xml;

class ReadEventXmlExample
{
    static void Main(string[] args)
    {
        String logName = "Application";
        String queryString = "*[System/Level=2]";

        EventLogQuery eventsQuery = new EventLogQuery(logName,
            PathType.LogName, queryString);

        EventLogReader logReader;
        Console.WriteLine("Querying the Application channel event log for all events...");
        try
        {
            // Query the log and create a stream of selected events
            logReader = new EventLogReader(eventsQuery);
        }
        catch (EventLogNotFoundException e)
        {
            Console.WriteLine("Failed to query the log!");
            Console.WriteLine(e);
            return;
        }

        int numberOfEvents = 0;
        // For each event returned from the query
        for (EventRecord eventInstance = logReader.ReadEvent();
                eventInstance != null;
                eventInstance = logReader.ReadEvent())
        {
            String eventXml = eventInstance.ToXml();
            Console.WriteLine("Event " + (++numberOfEvents) + " : " + System.Environment.NewLine + eventXml);
            Console.WriteLine("---------------------------------");
            //Console.ReadLine();
        }
    }
}

Compilar el código

Este ejemplo de código requiere referencias a los archivos System.dll y System.Core.dll.

Ejemplo

Descripción

En el siguiente ejemplo de código se utiliza la clase EventLogPropertySelector para representar una instancia de evento como una lista de valores especificados. Los valores especificados son el usuario que ha registrado el evento, la hora en la que se ha creado el evento, el identificador del evento y el identificador del registro de eventos.

Código

Imports System
Imports System.Collections.Generic
Imports System.Text
Imports System.Diagnostics.Eventing.Reader

Public Class ReadEventValuesExample

    Public Shared Function Main( _
    ByVal args() As String) As Integer

        Dim logName As String = "Application"
        Dim queryString As String = "*[System/Level=2]"

        Dim eventsQuery As New EventLogQuery(logName, _
            PathType.LogName, queryString)

        Dim logReader As EventLogReader
        Console.WriteLine("Querying the Application channel event log for all events...")

        Try
            ' Query the log
            logReader = New EventLogReader(eventsQuery)

        Catch e As EventLogNotFoundException

            Console.WriteLine("Failed to query the log!")
            Console.WriteLine(e)
            Return 1
        End Try

        '''''''
        ' This section creates a list of XPath reference strings to select
        ' the properties that we want to display
        ' In this example, we will extract the User, TimeCreated, EventID and EventRecordID
        '''''''
        ' Array of strings containing XPath references
        Dim xPathRefs(3) As String
        xPathRefs(0) = "Event/System/Security/@UserID"
        xPathRefs(1) = "Event/System/TimeCreated/@SystemTime"
        xPathRefs(2) = "Event/System/EventID"
        xPathRefs(3) = "Event/System/EventRecordID"

        ' Place those strings in an IEnumberable object
        Dim xPathEnum As IEnumerable(Of String) = xPathRefs
        ' Create the property selection context using the XPath reference
        Dim logPropertyContext As New EventLogPropertySelector(xPathEnum)

        Dim numberOfEvents As Integer = 0

        ' For each event returned from the query
        Dim eventInstance As EventLogRecord = logReader.ReadEvent()
        While Not eventInstance Is Nothing
            Dim logEventProps As IList(Of Object)

            Try
                ' Cast the EventRecord into an EventLogRecord to retrieve property values.
                ' This will fetch the event properties we requested through the
                ' context created by the EventLogPropertySelector
                logEventProps = eventInstance.GetPropertyValues(logPropertyContext)
                Console.WriteLine("Event {0} :", ++numberOfEvents)
                Console.WriteLine("User: {0}", logEventProps(0))
                Console.WriteLine("TimeCreated: {0}", logEventProps(1))
                Console.WriteLine("EventID: {0}", logEventProps(2))
                Console.WriteLine("EventRecordID : {0}", logEventProps(3))

                ' Event properties can also be retrived through the event instance
                Console.WriteLine("Event Description:" + eventInstance.FormatDescription())
                Console.WriteLine("MachineName: " + eventInstance.MachineName)

            Catch e As Eventing.Reader.EventLogException
                Console.WriteLine("Couldn't render event!")
                Console.WriteLine("Exception: Event {0} may not have an XML representation \n\n", ++numberOfEvents)
                Console.WriteLine(e)
            End Try

            eventInstance = logReader.ReadEvent()
        End While
    End Function
End Class

using System;
using System.Collections.Generic;
using System.Text;
using System.Diagnostics.Eventing.Reader;

class ReadEventValuesExample
{
    static void Main(string[] args)
    {
        String logName = "Application";
        String queryString = "*[System/Level=2]";

        EventLogQuery eventsQuery = new EventLogQuery(logName,
            PathType.LogName, queryString);

        EventLogReader logReader;
        Console.WriteLine("Querying the Application channel event log for all events...");
        try
        {
            // Query the log
            logReader = new EventLogReader(eventsQuery);
        }
        catch (EventLogNotFoundException e)
        {
            Console.WriteLine("Failed to query the log!");
            Console.WriteLine(e);
            return;
        }

        //////
        // This section creates a list of XPath reference strings to select
        // the properties that we want to display
        // In this example, we will extract the User, TimeCreated, EventID and EventRecordID
        //////
        // Array of strings containing XPath references
        String[] xPathRefs = new String[4];
        xPathRefs[0] = "Event/System/Security/@UserID";
        xPathRefs[1] = "Event/System/TimeCreated/@SystemTime";
        xPathRefs[2] = "Event/System/EventID";
        xPathRefs[3] = "Event/System/EventRecordID";
        // Place those strings in an IEnumberable object
        IEnumerable<String> xPathEnum = xPathRefs;
        // Create the property selection context using the XPath reference
        EventLogPropertySelector logPropertyContext = new EventLogPropertySelector(xPathEnum);

        int numberOfEvents = 0;
        // For each event returned from the query
        for (EventRecord eventInstance = logReader.ReadEvent();
                eventInstance != null;
                eventInstance = logReader.ReadEvent())
        {
            IList<object> logEventProps;
            try
            {
                // Cast the EventRecord into an EventLogRecord to retrieve property values.
                // This will fetch the event properties we requested through the
                // context created by the EventLogPropertySelector
                logEventProps = ((EventLogRecord)eventInstance).GetPropertyValues(logPropertyContext);
                Console.WriteLine("Event {0} :", ++numberOfEvents);
                Console.WriteLine("User: {0}", logEventProps[0]);
                Console.WriteLine("TimeCreated: {0}", logEventProps[1]);
                Console.WriteLine("EventID: {0}", logEventProps[2]);
                Console.WriteLine("EventRecordID : {0}", logEventProps[3]);

                // Event properties can also be retrived through the event instance
                Console.WriteLine("Event Description:" + eventInstance.FormatDescription());
                Console.WriteLine("MachineName: " + eventInstance.MachineName);
            }
            catch (Exception e)
            {
                Console.WriteLine("Couldn't render event!");
                Console.WriteLine("Exception: Event {0} may not have an XML representation \n\n", ++numberOfEvents);
                Console.WriteLine(e);
            }
        }
    }
}

Compilar el código

Este ejemplo requiere referencias a los archivos System.dll y System.Core.dll.

Consulte también

Conceptos

Escenarios de registros de eventos

Enviar comentarios sobre este tema a Microsoft.

Copyright © 2007 Microsoft Corporation. Reservados todos los derechos.