How to use WMI to collect a fixed number of sys logs at one time

[Loug52]

I am writing a small program that using WMI to get windows security logs. The programm suppose to get 50 logs each time and dump them into a text file, then stop. Currently, my code can start to collect logs, but never stop. Could anyone tell me how to do this? I tried to modify the WMI query, but it seems the WMI query has very limited functions. Thank you very much. ---------------------------------------------------------------------------- using System; using System.Management; using System.IO; class Sample_ManagementEventWatcher { [STAThread] public static int Main(string[] args) { /*create a text for saving records*/ StreamWriter SW; SW=File.CreateText("logs.txt"); SW.Close(); /*end of mod*/ MyHandler mh; EventArrivedEventHandler eventArrivedEventHandler; ManagementEventWatcher watcher; string comp = "servername"; mh = new MyHandler(); eventArrivedEventHandler = new EventArrivedEventHandler(mh.Arrived); watcher = Sample_ManagementEventWatcher.getWatcher(comp); watcher.EventArrived += eventArrivedEventHandler; watcher.Start(); Console.WriteLine("Watcher is running, press to stop..."); Console.ReadLine(); watcher.Stop(); watcher.EventArrived -= eventArrivedEventHandler; return 0; } public static ManagementEventWatcher getWatcher(string comp) { ConnectionOptions co; ManagementPath mp; ManagementScope ms; WqlEventQuery EventQuery; ManagementEventWatcher watcher; string wql; string wqlAnd; co = new ConnectionOptions(); co.Timeout = new TimeSpan(0, 0, 60); co.EnablePrivileges = true; mp = new ManagementPath(); mp.NamespacePath = @"\root\cimv2"; mp.Server = comp; ms = new ManagementScope(mp, co); wqlAnd = " AND TargetInstance.Logfile ='Security'"; wql = "select * from __instancecreationevent where targetinstance isa 'Win32_NTLogEvent'" + wqlAnd; EventQuery = new WqlEventQuery(wql); watcher = new ManagementEventWatcher(ms, EventQuery); return watcher; } public class MyHandler { public void Arrived(object sender, EventArrivedEventArgs e) { ManagementBaseObject mbo = (ManagementBaseObject)e.NewEvent["TargetInstance"]; Console.WriteLine(mbo.GetText(0)); /*write the logs.txt file */ StreamWriter SW; SW=File.AppendText("logs.txt"); SW.WriteLine(mbo.GetText(0)); SW.Close(); /*end of mod file*/ } } }//Namespace.