EventLogQuery: how to form a query string?

Question

I have the following code:

string query = "???"; EventLogQuery elq = new EventLogQuery("Application", PathType.LogName, query); elq.Session = new EventLogSession("xxxx"); EventLogReader elr = new EventLogReader(elq); 

I am trying to figure out what I need to ask a query in order to search all records with the source "SQLSERVERAGENT".

Answer 1

I just spent an hour trying to solve this for myself, and thought that I would be returning to a solution for everyone who comes here. Comments should be sufficiently explanatory.

  public void ReadSqlAgentEventMessages() { // Force culture to en-US if required, some people get a null from FormatDescription() and this appently solves it. // My culture is set as en-GB and I did not have the issue, so I have left it as a comment to possibly ease someone pain! // Thread.CurrentThread.CurrentCulture = new CultureInfo("en-US"); EventLogQuery eventlogQuery = new EventLogQuery("Application", PathType.LogName, "*[System/Provider/@Name=\"SQLSERVERAGENT\"]"); EventLogReader eventlogReader = new EventLogReader(eventlogQuery); // Loop through the events returned for (EventRecord eventRecord = eventlogReader.ReadEvent(); null != eventRecord; eventRecord = eventlogReader.ReadEvent()) { // Get the description from the eventrecord. string message = eventRecord.FormatDescription(); // Do something cool with it :) } }