How to: Read Event Log Entries 

You use the Entries collection to look at the entries in a particular event log. You can use standard collection properties such as Count and Item to work with the elements the collection contains. You might read event log entries to find out more information about a problem that occurred in your system, to identify usage patterns, or to identify problems (such as a failing hard disk drive) before they cause damage.

Note
The Entries collection is read-only; to write a message to a log you must use the WriteEntry method. For information, see How to: Write Entries to Event Logs.

If you ask for the count of entries in a new custom log that has not yet been written to, the system will return the count of the entries in the Application log on that server. Make sure that logs you are counting have been created and written to in order to avoid this problem.

Note
There are security restrictions that affect your ability to use event logs. For more information, see Security Ramifications of Event Logs.

Security Note
Treat the data from an event log as you would any other input coming from outside your system. Your application may need to validate the data in the event log before using it as input. Another process, possibly a malicious one, may have accessed the event log and added entries.

To read event log entries

1. Create an instance of the EventLog component. For more information, see How to: Create EventLog Component Instances.

2. Set the Log and MachineName properties for the component. For more information, see How to: Configure EventLog Component Instances.

3. Use the Entries collection to review the entries in the log. The following example shows how to retrieve all of the entries from a log.

   Dim entry As EventLogEntry
   For Each entry In EventLog1.Entries
       Console.WriteLine(entry.Message)
   Next
   

   foreach (System.Diagnostics.EventLogEntry entry in EventLog1.Entries)
   {
       Console.WriteLine(entry.Message);
   
   }
   

   IEnumerator e = EventLog1.get_Entries().GetEnumerator();
   while( e.MoveNext()) {
      System.Diagnostics.EventLogEntry entry = 
         (System.Diagnostics.EventLogEntry)e.get_Current();
      Console.WriteLine(entry.get_Message());
   }
   

See Also

Tasks

How to: Handle the EntryWritten Event
Walkthrough: Exploring Event Logs, Event Sources, and Entries

Concepts

Introduction to the EventLog Component