This documentation is archived and is not being maintained.

EventLog Class

Provides interaction with Windows event logs.

For a list of all members of this type, see EventLog Members.


[Visual Basic]
Public Class EventLog
   Inherits Component
   Implements ISupportInitialize
public class EventLog : Component, ISupportInitialize
public __gc class EventLog : public Component, ISupportInitialize
public class EventLog extends Component implements

Thread Safety

Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.


EventLog lets you access or customize Windows 2000 event logs, which record information about important software or hardware events. Using EventLog, you can read from existing logs, write entries to logs, create or delete event sources, delete logs, and respond to log entries. You can also create new logs when creating an event source.

If the log that you specify in a call to CreateEventSource does not exist on the computer, the system creates a custom log and registers your application as a source for that log. Use the EventLog class to read and write entries to any event log for which you have the appropriate access.

Note   The Security log is read-only.

If you write to an event log, you must specify or create an event Source. The Source registers your application with the event log as a valid source of entries. You can only use the Source to write to one log at a time. The Source can be any random string, but the name must be distinct from other sources on the computer. It is common for the source to be the name of the application or another identifying string. An attempt to create a duplicated Source value throws an exception. However, a single event log can be associated with multiple sources.

To read from a log, specify the Log name and MachineName (server computer name) for the EventLog. It is not necessary to specify the Source, as a source is required only for writing to logs. The Entries member is automatically populated with the event log's list of entries.

Note   You are not required to specify the MachineName if you are connecting to a log by specifying a Log/ MachineName pair. If you do not specify the MachineName, the local computer, ".", is assumed.

When writing to an event log, you can specify the type of information sent with the message parameter. In addition to sending the message, you can send an EventLogEntryType to indicate whether the message is an error, warning, or information entry type. You can also specify application-defined eventId and category parameters to display in the Type and Category columns of the event viewer. Finally, you can also attach binary data to your event entry if you need to associate additional information with a given event.

In addition to accessing individual event logs and their entries, the EventLog class provides access to the collection of all event logs. You can use the static (Shared in Visual Basic) members of EventLog to delete logs, get log lists, create or delete a source, or determine if a computer already contains a particular source.

Windows 2000 has three default logs: Application, System, and Security. Other installed applications and services, such as Active Directory, can have additional event logs. You can use EventLog to create custom event logs you can view through the server's Event Viewer.

Event logging consumes disk space, processor time, and other system resources. It is important to log only essential information. It is recommended that you place event log calls in an error path, rather than in the main code path, so as not to adversely affect performance.

For a list of initial property values for an instance of EventLog, see the EventLog constructor.


[Visual Basic, C#, C++] The following example writes an entry to an event log, "MyNewLog", on the local computer, and creates the source "MySource" if it does not already exist.

[Visual Basic, C#, C++] Note   It is not necessary for you to create the event source in your code. If the source you set in the Source property does not exist, the WriteEntry method creates it before writing to the event log.
[Visual Basic] 
Option Explicit
Option Strict

Imports System
Imports System.Diagnostics
Imports System.Threading

Class MySample
    Public Shared Sub Main()
        ' Create the source, if it does not already exist.
        If Not EventLog.SourceExists("MySource") Then
            EventLog.CreateEventSource("MySource", "MyNewLog")
        End If
        ' Create an EventLog instance and assign its source.
        Dim myLog As New EventLog()
        myLog.Source = "MySource"
        ' Write an informational entry to the event log.    
        myLog.WriteEntry("Writing to event log.")
    End Sub 'Main 
End Class 'MySample

using System;
using System.Diagnostics;
using System.Threading;
class MySample{

    public static void Main(){
        // Create the source, if it does not already exist.
            EventLog.CreateEventSource("MySource", "MyNewLog");
        // Create an EventLog instance and assign its source.
        EventLog myLog = new EventLog();
        myLog.Source = "MySource";
        // Write an informational entry to the event log.    
        myLog.WriteEntry("Writing to event log.");

#using <mscorlib.dll>
#using <System.dll>
using namespace System;
using namespace System::Diagnostics;
using namespace System::Threading;

int main(){

    // Create the source, if it does not already exist.
        EventLog::CreateEventSource(S"MySource", S"MyNewLog");

    // Create an EventLog instance and assign its source.
    EventLog* myLog = new EventLog();
    myLog->Source = S"MySource";

    // Write an informational entry to the event log.    
    myLog->WriteEntry(S"Writing to event log.");


[JScript] No example is available for JScript. To view a Visual Basic, C#, or C++ example, click the Language Filter button Language Filter in the upper-left corner of the page.


Namespace: System.Diagnostics

Platforms: Windows NT Server 4.0, Windows NT Workstation 4.0, Windows 2000, Windows XP Home Edition, Windows XP Professional, Windows Server 2003 family

Assembly: System (in System.dll)

.NET Framework Security: 

See Also

EventLog Members | System.Diagnostics Namespace | EventLogEntry | EntryWrittenEventArgs | ServiceBase