I am writing a small program that using WMI to get windows security logs. The programm suppose to get 50 logs each time and dump them into a text file, then stop. Currently, my code can start to collect logs, but never stop. Could anyone tell me how to do this? I tried to modify the WMI query, but it seems the WMI query has very limited functions. Thank you very much. ---------------------------------------------------------------------------- using System; using System.Management; using System.IO; class Sample_ManagementEventWatcher { [STAThread] public static int Main(string[] args) { /*create a text for saving records*/ StreamWriter SW; SW=File.CreateText("logs.txt"); SW.Close(); /*end of mod*/ MyHandler mh; EventArrivedEventHandler eventArrivedEventHandler; ManagementEventWatcher watcher; string comp = "servername"; mh = new MyHandler(); eventArrivedEventHandler = new EventArrivedEventHandler(mh.Arrived); watcher = Sample_ManagementEventWatcher.getWatcher(comp); watcher.EventArrived += eventArrivedEventHandler; watcher.Start(); Console.WriteLine("Watcher is running, press to stop..."); Console.ReadLine(); watcher.Stop(); watcher.EventArrived -= eventArrivedEventHandler; return 0; } public static ManagementEventWatcher getWatcher(string comp) { ConnectionOptions co; ManagementPath mp; ManagementScope ms; WqlEventQuery EventQuery; ManagementEventWatcher watcher; string wql; string wqlAnd; co = new ConnectionOptions(); co.Timeout = new TimeSpan(0, 0, 60); co.EnablePrivileges = true; mp = new ManagementPath(); mp.NamespacePath = @"\root\cimv2"; mp.Server = comp; ms = new ManagementScope(mp, co); wqlAnd = " AND TargetInstance.Logfile ='Security'"; wql = "select * from __instancecreationevent where targetinstance isa 'Win32_NTLogEvent'" + wqlAnd; EventQuery = new WqlEventQuery(wql); watcher = new ManagementEventWatcher(ms, EventQuery); return watcher; } public class MyHandler { public void Arrived(object sender, EventArrivedEventArgs e) { ManagementBaseObject mbo = (ManagementBaseObject)e.NewEvent["TargetInstance"]; Console.WriteLine(mbo.GetText(0)); /*write the logs.txt file */ StreamWriter SW; SW=File.AppendText("logs.txt"); SW.WriteLine(mbo.GetText(0)); SW.Close(); /*end of mod file*/ } } }//Namespace.

Thanks for replying. the code is running under admin privileges.

Hi, all. I am working on a C# code that can retrieve system log by using WMI. However, the code is working fine under windows 2000, but got error messages under Windows XP. The erro message is : Unhandled Exception: System.Management.ManagementException:Access denied. at System.Management.Management.Exception.ThrowWithExtendedInfo(ManagementStatus errorCode) at System.Management.ManagementEventWatcher.Start() Part of my code is like following and I believe this is where the problem at: ---------------------------------------------------------------- public static ManagementEventWatcher getWatcher(string comp, string LogName) { ConnectionOptions co; ManagementPath mp; ManagementScope ms; WqlEventQuery EventQuery; ManagementEventWatcher watcher; string wql; string wqlAnd; co = new ConnectionOptions(); co.Timeout = new TimeSpan(0, 0, 60); co.EnablePrivileges = true; mp = new ManagementPath(); mp.NamespacePath = @"\root\cimv2"; mp.Server = comp; // comp is the computer you are connecting to ms = new ManagementScope(mp, co); Console.WriteLine("host is" + comp +"Logname is "+LogName); switch(LogName.ToUpper()) { case "ALL": wqlAnd = ""; break; case "SECURITY": wqlAnd = " AND TargetInstance.Logfile ='Security'"; break; case "SYSTEM": wqlAnd = " AND TargetInstance.Logfile ='System'"; break; case "APPLICATION": wqlAnd = " AND TargetInstance.Logfile ='Application'"; break; default: wqlAnd = ""; break;