如何：访问和读取事件信息

如果从事件查询或订阅中获取了事件实例，则可以读取事件属性的值。若要执行此操作，请获取事件的 XML 表示或指定要读取属性的名称。

有关如何查询事件的详细信息，请参阅如何：查询事件。有关如何订阅事件的详细信息，请参阅如何：订阅事件日志中的事件。

示例

说明

下面的代码示例在应用程序日志中查询所有级别为 2 的事件，然后显示每个事件的 XML 表示。从事件查询返回的每个事件实例都由一个 EventRecord 实例表示。调用 ToXml 方法以获取该事件的 XML 表示。

代码

Imports System
Imports System.Text
Imports System.Diagnostics.Eventing.Reader
Imports System.Xml

Public Class ReadEventXmlExample

    Public Overloads Shared Function Main( _
    ByVal args() As String) As Integer

        Dim logName As String = "Application"
        Dim queryString As String = "*[System/Level=2]"

        Dim eventsQuery As New EventLogQuery(logName, _
            PathType.LogName, queryString)

        Dim logReader As EventLogReader
        Console.WriteLine("Querying the Application channel event log for all events...")
        Try

            ' Query the log and create a stream of selected events
            logReader = New EventLogReader(eventsQuery)

        Catch e As EventLogNotFoundException

            Console.WriteLine("Failed to query the log!")
            Console.WriteLine(e)
            Return 1
        End Try

        Dim numberOfEvents As Integer = 0

        ' For each event returned from the query
        Dim eventInstance As EventRecord = logReader.ReadEvent()
        While Not eventInstance Is Nothing

            Dim eventXml As String = eventInstance.ToXml()
            Console.WriteLine("Event " & (++numberOfEvents) & " : " & _
                System.Environment.NewLine & eventXml)
            Console.WriteLine("---------------------------------")
            eventInstance = logReader.ReadEvent()
        End While

    End Function
End Class

using System;
using System.Text;
using System.Diagnostics.Eventing.Reader;
using System.Xml;

class ReadEventXmlExample
{
    static void Main(string[] args)
    {
        String logName = "Application";
        String queryString = "*[System/Level=2]";

        EventLogQuery eventsQuery = new EventLogQuery(logName,
            PathType.LogName, queryString);

        EventLogReader logReader;
        Console.WriteLine("Querying the Application channel event log for all events...");
        try
        {
            // Query the log and create a stream of selected events
            logReader = new EventLogReader(eventsQuery);
        }
        catch (EventLogNotFoundException e)
        {
            Console.WriteLine("Failed to query the log!");
            Console.WriteLine(e);
            return;
        }

        int numberOfEvents = 0;
        // For each event returned from the query
        for (EventRecord eventInstance = logReader.ReadEvent();
                eventInstance != null;
                eventInstance = logReader.ReadEvent())
        {
            String eventXml = eventInstance.ToXml();
            Console.WriteLine("Event " + (++numberOfEvents) + " : " + System.Environment.NewLine + eventXml);
            Console.WriteLine("---------------------------------");
            //Console.ReadLine();
        }
    }
}

编译代码

此代码示例需要引用 System.dll 和 System.Core.dll 文件。

示例

说明

下面的代码示例使用 EventLogPropertySelector 类，以指定值的列表形式呈现事件实例。指定的值包括记录事件的用户、创建事件的时间、事件标识符和事件记录标识符。

代码

Imports System
Imports System.Collections.Generic
Imports System.Text
Imports System.Diagnostics.Eventing.Reader

Public Class ReadEventValuesExample

    Public Shared Function Main( _
    ByVal args() As String) As Integer

        Dim logName As String = "Application"
        Dim queryString As String = "*[System/Level=2]"

        Dim eventsQuery As New EventLogQuery(logName, _
            PathType.LogName, queryString)

        Dim logReader As EventLogReader
        Console.WriteLine("Querying the Application channel event log for all events...")

        Try
            ' Query the log
            logReader = New EventLogReader(eventsQuery)

        Catch e As EventLogNotFoundException

            Console.WriteLine("Failed to query the log!")
            Console.WriteLine(e)
            Return 1
        End Try

        '''''''
        ' This section creates a list of XPath reference strings to select
        ' the properties that we want to display
        ' In this example, we will extract the User, TimeCreated, EventID and EventRecordID
        '''''''
        ' Array of strings containing XPath references
        Dim xPathRefs(3) As String
        xPathRefs(0) = "Event/System/Security/@UserID"
        xPathRefs(1) = "Event/System/TimeCreated/@SystemTime"
        xPathRefs(2) = "Event/System/EventID"
        xPathRefs(3) = "Event/System/EventRecordID"

        ' Place those strings in an IEnumberable object
        Dim xPathEnum As IEnumerable(Of String) = xPathRefs
        ' Create the property selection context using the XPath reference
        Dim logPropertyContext As New EventLogPropertySelector(xPathEnum)

        Dim numberOfEvents As Integer = 0

        ' For each event returned from the query
        Dim eventInstance As EventLogRecord = logReader.ReadEvent()
        While Not eventInstance Is Nothing
            Dim logEventProps As IList(Of Object)

            Try
                ' Cast the EventRecord into an EventLogRecord to retrieve property values.
                ' This will fetch the event properties we requested through the
                ' context created by the EventLogPropertySelector
                logEventProps = eventInstance.GetPropertyValues(logPropertyContext)
                Console.WriteLine("Event {0} :", ++numberOfEvents)
                Console.WriteLine("User: {0}", logEventProps(0))
                Console.WriteLine("TimeCreated: {0}", logEventProps(1))
                Console.WriteLine("EventID: {0}", logEventProps(2))
                Console.WriteLine("EventRecordID : {0}", logEventProps(3))

                ' Event properties can also be retrived through the event instance
                Console.WriteLine("Event Description:" + eventInstance.FormatDescription())
                Console.WriteLine("MachineName: " + eventInstance.MachineName)

            Catch e As Eventing.Reader.EventLogException
                Console.WriteLine("Couldn't render event!")
                Console.WriteLine("Exception: Event {0} may not have an XML representation \n\n", ++numberOfEvents)
                Console.WriteLine(e)
            End Try

            eventInstance = logReader.ReadEvent()
        End While
    End Function
End Class

using System;
using System.Collections.Generic;
using System.Text;
using System.Diagnostics.Eventing.Reader;

class ReadEventValuesExample
{
    static void Main(string[] args)
    {
        String logName = "Application";
        String queryString = "*[System/Level=2]";

        EventLogQuery eventsQuery = new EventLogQuery(logName,
            PathType.LogName, queryString);

        EventLogReader logReader;
        Console.WriteLine("Querying the Application channel event log for all events...");
        try
        {
            // Query the log
            logReader = new EventLogReader(eventsQuery);
        }
        catch (EventLogNotFoundException e)
        {
            Console.WriteLine("Failed to query the log!");
            Console.WriteLine(e);
            return;
        }

        //////
        // This section creates a list of XPath reference strings to select
        // the properties that we want to display
        // In this example, we will extract the User, TimeCreated, EventID and EventRecordID
        //////
        // Array of strings containing XPath references
        String[] xPathRefs = new String[4];
        xPathRefs[0] = "Event/System/Security/@UserID";
        xPathRefs[1] = "Event/System/TimeCreated/@SystemTime";
        xPathRefs[2] = "Event/System/EventID";
        xPathRefs[3] = "Event/System/EventRecordID";
        // Place those strings in an IEnumberable object
        IEnumerable<String> xPathEnum = xPathRefs;
        // Create the property selection context using the XPath reference
        EventLogPropertySelector logPropertyContext = new EventLogPropertySelector(xPathEnum);

        int numberOfEvents = 0;
        // For each event returned from the query
        for (EventRecord eventInstance = logReader.ReadEvent();
                eventInstance != null;
                eventInstance = logReader.ReadEvent())
        {
            IList<object> logEventProps;
            try
            {
                // Cast the EventRecord into an EventLogRecord to retrieve property values.
                // This will fetch the event properties we requested through the
                // context created by the EventLogPropertySelector
                logEventProps = ((EventLogRecord)eventInstance).GetPropertyValues(logPropertyContext);
                Console.WriteLine("Event {0} :", ++numberOfEvents);
                Console.WriteLine("User: {0}", logEventProps[0]);
                Console.WriteLine("TimeCreated: {0}", logEventProps[1]);
                Console.WriteLine("EventID: {0}", logEventProps[2]);
                Console.WriteLine("EventRecordID : {0}", logEventProps[3]);

                // Event properties can also be retrived through the event instance
                Console.WriteLine("Event Description:" + eventInstance.FormatDescription());
                Console.WriteLine("MachineName: " + eventInstance.MachineName);
            }
            catch (Exception e)
            {
                Console.WriteLine("Couldn't render event!");
                Console.WriteLine("Exception: Event {0} may not have an XML representation \n\n", ++numberOfEvents);
                Console.WriteLine(e);
            }
        }
    }
}

编译代码

此示例需要引用 System.dll 和 System.Core.dll 文件。

请参见

概念

事件日志方案

向 Microsoft 发送对本主题的评论。

版权所有 (C) 2007 Microsoft Corporation。保留所有权利。