This documentation is archived and is not being maintained.

EventLog::GetEventLogs Method

Searches for all event logs on the local computer and creates an array of EventLog objects that contain the list.

Namespace:  System.Diagnostics
Assembly:  System (in System.dll)

static array<EventLog^>^ GetEventLogs()

Return Value

Type: array<System.Diagnostics::EventLog>
An array of type EventLog that represents the logs on the local computer.


You do not have read access to the registry.


There is no event log service on the computer.

The array of EventLog objects is a snapshot of all event logs on the local computer when the call to GetEventLogs is made. This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. You should verify that a log in the array exists before you read or write to it. The array usually includes at least three logs: Application, System, and Security. If you created custom logs on the local computer, they will appear in the array as well.

To retrieve the list of event logs, you must have the appropriate registry permissions. These permissions are identical to those required to call Exists and SourceExists.

The following example enumerates the event logs defined on the local computer, and displays configuration details for each event log.

void DisplayEventLogProperties()

   // Iterate through the current set of event log files,
   // displaying the property settings for each file.
   array<EventLog^>^eventLogs = EventLog::GetEventLogs();
   System::Collections::IEnumerator^ myEnum = eventLogs->GetEnumerator();
   while ( myEnum->MoveNext() )
      EventLog^ e = safe_cast<EventLog^>(myEnum->Current);
      Int64 sizeKB = 0;
      Console::WriteLine( "{0}:", e->LogDisplayName );
      Console::WriteLine( "  Log name = \t\t {0}", e->Log );
      Console::WriteLine( "  Number of event log entries = {0}", e->Entries->Count );

      // Determine if there is a file for this event log.
      RegistryKey ^ regEventLog = Registry::LocalMachine->OpenSubKey( String::Format( "System\\CurrentControlSet\\Services\\EventLog\\{0}", e->Log ) );
      if ( regEventLog )
         Object^ temp = regEventLog->GetValue( "File" );
         if ( temp != nullptr )
            Console::WriteLine( "  Log file path = \t {0}", temp );
            FileInfo^ file = gcnew FileInfo( temp->ToString() );

            // Get the current size of the event log file.
            if ( file->Exists )
               sizeKB = file->Length / 1024;
               if ( (file->Length % 1024) != 0 )
               Console::WriteLine( "  Current size = \t {0} kilobytes", sizeKB );
            Console::WriteLine( "  Log file path = \t <not set>" );

      // Display the maximum size and overflow settings.
      sizeKB = e->MaximumKilobytes;
      Console::WriteLine( "  Maximum size = \t {0} kilobytes", sizeKB );
      Console::WriteLine( "  Overflow setting = \t {0}", e->OverflowAction );
      switch ( e->OverflowAction )
         case OverflowAction::OverwriteOlder:
            Console::WriteLine( "\t Entries are retained a minimum of {0} days.", e->MinimumRetentionDays );

         case OverflowAction::DoNotOverwrite:
            Console::WriteLine( "\t Older entries are not overwritten." );

         case OverflowAction::OverwriteAsNeeded:
            Console::WriteLine( "\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry." );


.NET Framework

Supported in: 4, 3.5, 3.0, 2.0, 1.1, 1.0

.NET Framework Client Profile

Supported in: 4, 3.5 SP1

Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows XP SP2 x64 Edition, Windows Server 2008 (Server Core not supported), Windows Server 2008 R2 (Server Core supported with SP1 or later), Windows Server 2003 SP2

The .NET Framework does not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.