GetEventLogs Method
Collapse the table of content
Expand the table of content

EventLog.GetEventLogs Method ()


Searches for all event logs on the local computer and creates an array of EventLog objects that contain the list.

Namespace:   System.Diagnostics
Assembly:  System (in System.dll)

public static EventLog[] GetEventLogs()

Return Value

Type: System.Diagnostics.EventLog[]

An array of type EventLog that represents the logs on the local computer.

Exception Condition

You do not have read access to the registry.


There is no event log service on the computer.

The array of EventLog objects is a snapshot of all event logs on the local computer when the call to GetEventLogs is made. This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. You should verify that a log in the array exists before you read or write to it. The array usually includes at least three logs: Application, System, and Security. If you created custom logs on the local computer, they will appear in the array as well.

To retrieve the list of event logs, you must have the appropriate registry permissions. These permissions are identical to those required to call Exists and SourceExists.

The following example enumerates the event logs defined on the local computer, and displays configuration details for each event log.

static void DisplayEventLogProperties()
    // Iterate through the current set of event log files,
    // displaying the property settings for each file.

    EventLog[] eventLogs = EventLog.GetEventLogs();
    foreach (EventLog e in eventLogs)
        Int64 sizeKB = 0;

        Console.WriteLine("{0}:", e.LogDisplayName);
        Console.WriteLine("  Log name = \t\t {0}", e.Log); 

        Console.WriteLine("  Number of event log entries = {0}", e.Entries.Count.ToString());

        // Determine if there is an event log file for this event log.
        RegistryKey regEventLog = Registry.LocalMachine.OpenSubKey("System\\CurrentControlSet\\Services\\EventLog\\" + e.Log);
        if (regEventLog != null)
            Object temp = regEventLog.GetValue("File");
            if (temp != null)
                Console.WriteLine("  Log file path = \t {0}", temp.ToString());
                FileInfo file = new FileInfo(temp.ToString());

                // Get the current size of the event log file.
                if (file.Exists)
                    sizeKB = file.Length / 1024;
                    if ((file.Length % 1024) != 0)
                    Console.WriteLine("  Current size = \t {0} kilobytes", sizeKB.ToString());
                Console.WriteLine("  Log file path = \t <not set>");

        // Display the maximum size and overflow settings.

        sizeKB = e.MaximumKilobytes;
        Console.WriteLine("  Maximum size = \t {0} kilobytes", sizeKB.ToString());
        Console.WriteLine("  Overflow setting = \t {0}", e.OverflowAction.ToString());

        switch (e.OverflowAction)
            case OverflowAction.OverwriteOlder:
                Console.WriteLine("\t Entries are retained a minimum of {0} days.", 
            case OverflowAction.DoNotOverwrite:
                Console.WriteLine("\t Older entries are not overwritten.");
            case OverflowAction.OverwriteAsNeeded:
                Console.WriteLine("\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry.");

for administering event log information on the computer. Associated enumeration: EventLogPermissionAccess.Administer

.NET Framework
Available since 1.1
Return to top
© 2015 Microsoft