View Event Logs without EventLog class?

[AhClem]

Hi, Are there any ways to get Event Log information from a remote box other than with the EventLog class? EventLog dumps the entire collection of log entries, for the specified log, as soon as it's opened. There is no way to throttle it, Read Next, or filter on anything besides "Source". The buffer size appears to be set at 40,000 and I don't see any way to change that (not that I'd want to). Everything was going great until I tried to get a a rather large log. And of course, the solution has to be entirely from the client side and I have no control over the size of the remote server logs. Any suggestions would be appreciated. Will

[Dave Kreskowiak]

Without using the EventLog class??? You'd have to come up with your own implementation of the class, P/Invoking all the Windows API calls and structures involved. You might be able to use the existing EventLog classes and just override or add new methods to read the events one at a time or implement an asynchronous version of the log download. You can find more about the Event Log API here[^]. If you look in the Contents in the left pane, you'll see Windows Event Log. Dont bother looking at it yet, it's the API used in Vista. It doesn't exist in lower versions of Windows, at least not yet... Dave Kreskowiak Microsoft MVP - Visual Basic -- modified at 10:53 Friday 14th April, 2006

[AhClem]

Thanks, I was just looking at ".NET Framework Solutions: In Search of the Lost Win32 API" over at Amazon. I haven't played with Win32 since the Windows 95 days so it's a little daunting for what should have been the simple part of the app. As far as extending the EventLog class. I don't see anything exposed as "protected" that could help me. Oh well! Will

[Dave Kreskowiak]

AhClem wrote:

As far as extending the EventLog class. I don't see anything exposed as "protected" that could help me.

Huh??? No, you create your own EventLog class! EIther by inheriting from the original EventLog class or by creating one from scratch. Then you can add your own methods to open the remote machine's event log and download each event, one at a time, from each log. Dave Kreskowiak Microsoft MVP - Visual Basic

[AhClem]

I understand. My point was that: in addition to the exposed (public) fields/properties, there are NO unexposed (protected) fields/properties in the FCL's EventLog class that would be nice to get at. So, there is no point in inheriting from it. There is nothing it would provide as a base class to make it any less useless to me. Will

[Dave Kreskowiak]

:laugh: Ahh! I see what you were gettin' at! Dave Kreskowiak Microsoft MVP - Visual Basic