Was this page helpful?
Your feedback about this content is important. Let us know what you think.
Additional feedback?
1500 characters remaining
GetEventLogs Method ()
Collapse the table of content
Expand the table of content

EventLog.GetEventLogs Method ()

Searches for all event logs on the local computer and creates an array of EventLog objects that contain the list.

Namespace: System.Diagnostics
Assembly: System (in system.dll)

'Declaration
Public Shared Function GetEventLogs As EventLog()
'Usage
Dim returnValue As EventLog()

returnValue = EventLog.GetEventLogs
public static EventLog[] GetEventLogs ()
public static function GetEventLogs () : EventLog[]
Not applicable.

Return Value

An array of type EventLog that represents the logs on the local computer.

Exception typeCondition

SystemException

You do not have read access to the registry.

-or-

There is no event log service on the computer.

The array of EventLog objects is a snapshot of all event logs on the local computer when the call to GetEventLogs is made. This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. You should verify that a log in the array exists before you read or write to it. The array usually includes at least three logs: Application, System, and Security. If you created custom logs on the local computer, they will appear in the array as well.

To retrieve the list of event logs, you must have the appropriate registry permissions. These permissions are identical to those required to call Exists and SourceExists.

The following example enumerates the event logs defined on the local computer, and displays configuration details for each event log.

Shared Sub DisplayEventLogProperties()

   ' Iterate through the current set of event log files,
   ' displaying the property settings for each file.
   Dim eventLogs As EventLog() = EventLog.GetEventLogs()
   
   Dim e As EventLog
   For Each e In  eventLogs
      Dim sizeKB As Int64 = 0
      
      Console.WriteLine()
      Console.WriteLine("{0}:", e.LogDisplayName)
      Console.WriteLine("  Log name = " + ControlChars.Tab _
                          + ControlChars.Tab + " {0}", e.Log)

      Console.WriteLine("  Number of event log entries = {0}", e.Entries.Count.ToString())
      
      ' Determine if there is an event log file for this event log.
      Dim regEventLog As RegistryKey
      regEventLog = Registry.LocalMachine.OpenSubKey( _
             ("System\CurrentControlSet\Services\EventLog\" + e.Log))

      If Not (regEventLog Is Nothing) Then

         Dim temp As Object = regEventLog.GetValue("File")
         If Not (temp Is Nothing) Then

            Console.WriteLine("  Log file path = " + ControlChars.Tab _
                                  + " {0}", temp.ToString())
            Dim file As New FileInfo(temp.ToString())
            
            ' Get the current size of the event log file.
            If file.Exists Then
               sizeKB = file.Length / 1024
               If file.Length Mod 1024 <> 0 Then
                  sizeKB += 1
               End If
               Console.WriteLine("  Current size = " + ControlChars.Tab _
                          + " {0} kilobytes", sizeKB.ToString())
            End If
         Else
            Console.WriteLine("  Log file path = " + ControlChars.Tab _
                             + " <not set>")
         End If
      End If
      
      ' Display the maximum size and overflow settings.
      sizeKB = e.MaximumKilobytes
      Console.WriteLine("  Maximum size = " + ControlChars.Tab _
                         + " {0} kilobytes", sizeKB.ToString())
      Console.WriteLine("  Overflow setting = " + ControlChars.Tab _
                         + " {0}", e.OverflowAction.ToString())
      
      Select Case e.OverflowAction
         Case OverflowAction.OverwriteOlder
            Console.WriteLine(ControlChars.Tab + _
                 " Entries are retained a minimum of {0} days.", _
                 e.MinimumRetentionDays)
         Case OverflowAction.DoNotOverwrite
            Console.WriteLine(ControlChars.Tab + _
                 " Older entries are not overwritten.")
         Case OverflowAction.OverwriteAsNeeded
            Console.WriteLine(ControlChars.Tab + _
                 " If number of entries equals max size limit, a new event log entry overwrites the oldest entry.")
         Case Else
      End Select

   Next e

End Sub

static void DisplayEventLogProperties()
{
    // Iterate through the current set of event log files,
    // displaying the property settings for each file.
    EventLog eventLogs[] = EventLog.GetEventLogs();
    EventLog e;
    for ( int iCtr = 0; iCtr < eventLogs.length; iCtr++ ) {
        e = eventLogs[iCtr];
        long sizeKB = 0;

        Console.WriteLine();
        Console.WriteLine("{0}:", e.get_LogDisplayName());
        Console.WriteLine("  Log name = \t\t {0}", e.get_Log());
        Console.WriteLine("  Number of event log entries = {0}",
            ((Int32)e.get_Entries().get_Count()).ToString());

        // Determine if there is an event log file for this event log.
        RegistryKey regEventLog = Registry.LocalMachine.
            OpenSubKey("System\\CurrentControlSet\\Services\\EventLog\\"
            + e.get_Log());

        if (regEventLog != null) {
            Object temp = regEventLog.GetValue("File");

            if (temp != null) {
                Console.WriteLine("  Log file path = \t {0}", 
                    temp.ToString());
                FileInfo file = new FileInfo(temp.ToString());
                // Get the current size of the event log file.
                if (file.get_Exists()) {
                    sizeKB = file.get_Length() / 1024;
                    if (file.get_Length() % 1024 != 0) {
                        sizeKB++;
                    }

                    Console.WriteLine("  Current size = \t {0} kilobytes",
                        ((Int64)sizeKB).ToString());
                }
            }
            else {
                Console.WriteLine("  Log file path = \t <not set>");
            }
        }

        // Display the maximum size and overflow settings.
        sizeKB = e.get_MaximumKilobytes();
        Console.WriteLine("  Maximum size = \t {0} kilobytes", 
            ((Int64)sizeKB).ToString());
        Console.WriteLine("  Overflow setting = \t {0}",
            e.get_OverflowAction().ToString());
        switch (e.get_OverflowAction()) {
            case OverflowAction.OverwriteOlder :
                Console.WriteLine("\t Entries are retained a minimum of "
                    + "{0} days.", (Int32)e.get_MinimumRetentionDays());
                break;
            case OverflowAction.DoNotOverwrite :
                Console.WriteLine("\t Older entries are not overwritten.");
                break;
            case OverflowAction.OverwriteAsNeeded :
                Console.WriteLine("\t If number of entries equals max "
                    + "size limit, a new event log entry overwrites "
                    + "the oldest entry.");
                break;
            default :
                break;
        }
    }
} //DisplayEventLogProperties

Windows Server 2000 SP4, Windows Server 2003, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP SP2, Windows XP Starter Edition

The Microsoft .NET Framework 3.0 is supported on Windows Vista, Microsoft Windows XP SP2, and Windows Server 2003 SP1.

.NET Framework

Supported in: 3.0, 2.0, 1.1, 1.0

Community Additions

ADD
Show:
© 2015 Microsoft