Is there a way to find out which EventLog raised the EntryWritten event in C #?

Question

I am working on a web application that displays event log data, similar to Event Viewer. The application should also enable users to subscribe to event logs and receive notifications when a record is written to signed logs using the web service.

I use this code to subscribe to an event log in a web service:

EventLog eventLog = new EventLog(observer.logName, observer.machineName);
eventLog.EnableRaisingEvents = true;
eventLog.EntryWritten += new EntryWrittenEventHandler(eventLog_EntryWritten);
eventList.Add(eventLog);

I am trying to use observers as event log subscribers, and when the EventWritten event is being processed, call the Update method for one observer. The problem is that I don’t know how to distinguish between event logs, since they all use the same event handler. I do this because the number of event logs differs from one computer to another. In addition, I want observers to process only one type of EventLog, i.e. one observer sends an email when an event is written to the application log.

I use this line of code to get all the logs on the current computer:

remoteEventLogs = EventLog.GetEventLogs(machineName);

EventWritten , Visual Studio EventLogInternal, , EventLog EventLog.Log. , :

void eventLog_EntryWritten(object sender, EntryWrittenEventArgs e)
    {
        var log = (EventLog)sender;
    }

, , EventLogInternal EventLog.

, EventLog ?

Answer 1

:

string log = (string)sender.GetType().GetProperty("Log").GetValue(sender, null);

sender Log.

Answer 2

, , EventLog , , Log - . , EventWrittenEventArgs, EventEntry , , EventLog. , , EventWritten.

System.Diagnostics.EventLog, :

class MyEventLog : EventLog
{
    public MyEventLog(string logName, string machineName)
        : base(logName, machineName)
    {
        base.EnableRaisingEvents = true;
        base.EntryWritten += MyEventLog_EntryWritten;
    }

    void MyEventLog_EntryWritten(object sender, EntryWrittenEventArgs e)
    {
        Console.WriteLine("Entry in {0} log.", base.Log);

        // Your code
    }
}

MyEventLog , EventLog. , .

" ", Action<string, EntryWrittenEventArgs>, MyEventLog_EntryWritten, "" .

Answer 3

, , , EntryWrittenEventArgs.

MSDN , , Entry, , . , EventLogEntry, MachineName UserName.

Args http://msdn.microsoft.com/en-us/library/system.diagnostics.entrywritteneventargs.aspx

Entry http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlogentry.aspx

, , Entry .

, .

Answer 4

I agree with the idea of ​​wrapping the EventLog class in another class, as suggested by Christian. I recently worked on such a requirement.

This is the class I created.

 public class EventLogWatcher : EventLog
{
    Action<string, EntryWrittenEventArgs> _changeHandler;
    public EventLogWatcher(string logName, Action<string, EntryWrittenEventArgs> changeHandler)
        : base(logName)
    {
        _changeHandler = changeHandler;
    }

    public void EnableCapture()
    {
        base.EnableRaisingEvents = true;
        base.EntryWritten += EventLogChangeHandler;
    }

    public void DisableCapture()
    {
        base.EnableRaisingEvents = false;
        base.EntryWritten -= EventLogChangeHandler;
    }

    private void EventLogChangeHandler(object sender, EntryWrittenEventArgs e)
    {
        _changeHandler(base.Log, e);
    }
}

Used here

 foreach (string eventlogType in LogTypes)
            logWatchers.Add(new EventLogWatcher(eventlogType, EventLogChangeHandler));

        foreach (EventLogWatcher localLog in logWatchers)
        {
            try
            {
                localLog.EnableCapture();
            }
            catch(Exception ex)
            {
                EventManager.PublishExceptionLogMessage(ex);
            }
        }
        EventManager.PublishInfoLogMessage($"Started EventLog listeners for {string.Join(",", LogTypes)} logs");

 private void EventLogChangeHandler(string eventLogType, EntryWrittenEventArgs e)
    {
        try
        {
            if (UploadAllowed(eventLogType, e))
            {

                Dm.EventLog model = _eventLogEntryMapper.MapEntryToModel(e);
                Task.Factory.StartNew(
                       () => _eventLogUploadService.UploadEventLog(model),
                       _cancellationTokenProvider.Token,
                       TaskCreationOptions.None,
                       TaskScheduler.Default);
            }
        }
        catch(Exception ex)
        {
            EventManager.PublishExceptionLogMessage(ex);
        }

    }