How to Query for an event log details with a given event id?

c#, events

Solution

There are a few new twists if your going to query events from the new style Windows EventLogs.

- You will have to use the classes from the `System.Diagnostics.Eventing.Reader` namespace to read the new events.

- Your query will be in Xpath form, so that time value is tricky, see msdn for the `EventLogQuery` definition.

- Your program will run into access issues, be ready to impersonate a user that's included in the `EventReaders` AD group on the logging machine.

This sample shows some of the new access methods:

string eventID = "5312";
string LogSource = "Microsoft-Windows-GroupPolicy/Operational";  
string sQuery = "*[System/EventID=" + eventID + "]";

var elQuery = new EventLogQuery(LogSource, PathType.LogName, sQuery);
using (var elReader = new System.Diagnostics.Eventing.Reader.EventLogReader(elQuery))
{

    List<EventRecord> eventList = new List<EventRecord>();
    EventRecord eventInstance = elReader.ReadEvent();
    try
    {
        for (null != eventInstance; eventInstance = elReader.ReadEvent())
        {
            //Access event properties here:
            //eventInstance.LogName;
            //eventInstance.ProviderName;
            eventList.Add(eventInstance);
        }
    }
    finally
    {
        if (eventInstance != null)
            eventInstance.Dispose();
    }
}

Problem

- How to know whether a particular event (given event ID, time and node as inputs) is logged or not? [In this case, I know only one event will be logged] - If the event is logged, how do I get details like event description, Log-name etc.. for eg, I want to query for an event under the node Applications and Services Logs > Microsoft > Windows > groupPolicy > Operational, and event id is 5315 and time is current time.

Original source