How to add multiple EventData lines to EventLog on Windows?

Question

I can currently create a Windows event log using the following code:

string sSource; string sLog; string sEvent; sSource = "Sample App"; sLog = "Application"; sEvent = "Sample Event"; if (!EventLog.SourceExists(sSource)) EventLog.CreateEventSource(sSource,sLog); EventLog.WriteEntry(sSource, sEvent, EventLogEntryType.Warning, 11111); 

This creates a log in the application log. I want to add several lines of data to the event log so that during debugging I can analyze the log directly for problems. In addition, I looked at some other application logs and they seem to have a binary data field in them. I could not figure out how to write such a field, because the above code snippet adds only the EventData field.

Answer 1

I tried using \ n \ t with EventLog.WriteEntry (). However, I was not successful. I found a solution to this problem. We can use logger.WriteEvent ()

 //Object of eventinstance. EventInstance eventInstance= new EventInstance(0, 0) {EntryType = EventLogEntryType.Warning}; //Array of string.Event data node is generated based on the array size. string [] eventLog = EventLogger.BuildEventLog("EventLogSamples.WriteEventSample2","test"); //Need to specify the source EventLog log = new EventLog {Source = "source"}; log.WriteEvent(eventInstance, eventLog); 

I was able to successfully write multiple eventData as below

 - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> - <System> <Provider Name="test" /> </System> - <EventData> <Data>EventLogSamples.WriteEventSample2</Data> <Data>test</Data> </EventData> </Event> 

Please let me know if you find any problems. PC (Pratap Kudupu)

Answer 2

One insert should look like this:

 EventLog.WriteEvent("Application", new EventInstance(123, 0, EventLogEntryType.Information), new object[] { "Entry1" , "Entry2" }); 

Here the Application is the source of the event, 123 is the identifier of the event and 0 = NONE is the category of the event. You may need to check for the source of the event first.

Here's what the event looks like:

  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Application" /> <EventID Qualifiers="0">1001</EventID> <Level>4</Level> <Task>0</Task> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2015-07-12T21:26:07.000000000Z" /> <EventRecordID>86554</EventRecordID> <Channel>Application</Channel> <Computer>YOUR_COMPUTER</Computer> <Security /> </System> <EventData> <Data>Entry1</Data> <Data>Entry2</Data> </EventData> </Event> 

Answer 3

I got a litta, embarrassed by Pratap Kudpu's answer, and I rewrote {string sSource = "Application Name"; string sLog = "Application";

  EventInstance eventInstance = new EventInstance(0, 0, EventLogEntryType.Error); List<string> sEvent = new List<string>(); sEvent.Add("Message 1"); sEvent.Add("Message 2"); sEvent.Add("Message 3"); //Check if Event Source was created (Possibly throw error if you are not running with high privilege) if (!EventLog.SourceExists(sSource)) EventLog.CreateEventSource(sSource, sLog); EventLog.WriteEvent(sSource, eventInstance, sEvent.ToArray()); 

}

Basically, you create a list of lines with "Lines" or the data you want, create an EventInstance object and write an event instead of WriteEntry

Result:

  <EventData> <Data>Message 1</Data> <Data>Message 2</Data> <Data>Message 3</Data> </EventData> 

Answer 4

If you want to add more lines, you can simply add "Enviroment.NewLine"

  [Extension()] [MethodImpl(MethodImplOptions.NoInlining)] public void WriteInfo(string info) { try { MethodBase callingMethod = new StackFrame(1, true).GetMethod(); string typeCalling = callingMethod.DeclaringType.FullName; string baseStr = "TYPE: {0}{3} METHOD: {1}{3} DETAIL: {2}"; baseStr = string.Format(baseStr, new object[] { callingMethod, typeCalling, info, Environment.NewLine }); EventLog.WriteEntry("entryName", baseStr, EventLogEntryType.Information); } catch { Debugger.Break(); } } 

Answer 5

Simply enter line break characters in the message line to write multiple lines of text.