Managing EventLogs in Event Viewer using .Net

Event Viewer (Start->Run->eventvwr) records the software or application specific, hardware, security events. It maintains log information about issues or errors occured on the system or any application. The information can be quite useful as it gives the date/time and the message and description about the issues which helps debug further.

Logging is one of the most crucial aspect of software programming. One can have custom logging mechanisms for their applications. Eventlog can also be used to log custom logs by defining them in custom application specific EventSources. In this article, we will see how to read/write entries, delete logs, create/delete EventSources. The logs can be written or accessed from a local or a remote machine.

To perform the above operations, we need EventLog class. They can be found in System.Diagnostics namespace.

Examples:
a. Read log entries from Application Log.

While reading LogEntries, you must specify the Log from where you want to read the messages. The example below displays only the messages. We can get complete log details from each entry.

static void Main(string[] args)
{
//Read EventLogEntries
EventLog _evtLog = new EventLog();
_evtLog.Log = "Application";

foreach (EventLogEntry entries in _evtLog.Entries)
{
Console.WriteLine("Entry: " + entries.Message);
Console.Read();
}
}

b. Write event log entries in the EventLog.

While writing Event Log entries, you must specify the EventSource against which your messages are written. Its good to create custom EventSource for your application which distinguishes your messages related to your application. You must also specify the EventLogEntryType (enum) which denotes the type of the message being logged.

static void Main(string[] args)
{
EventLog _evtLog = new EventLog();
try
{
//Check if the source already exists
if (!EventLog.SourceExists("testAppName"))
{
//create event source
EventLog.CreateEventSource("testAppName", "testLogName");
}

//write message
_evtLog.Source = "testAppName";
_evtLog.WriteEntry("testMessage", EventLogEntryType.Information);
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
Console.Read();
}
}

c. Delete the EventLogSource.

To delete the EventLogSource, you can use EventLog class's DeleteEventSource() static method.

static void Main(string[] args)
{
try
{
//Check if the source already exists
if (!EventLog.SourceExists("testAppName"))
{
//Delete event source
EventLog.DeleteEventSource("testAppName", "."); //deletes 'testAppName' Source from the local machine
}

}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
Console.Read();
}
}

In order to delete specific logs, you can get the list of logs using GetEventLog() method of EventLog class, filter them and delete using the Delete() method.

EventLog.Delete(logName);

Refer MSDN for more details.