Procedura: accedere e leggere le informazioni eventi
Quando si acquisisce l'istanza di un evento da una query eventi o da una sottoscrizione, è possibile leggere il valore delle proprietà relative all'evento. A tale scopo, acquisire la rappresentazione XML dell'evento o specificare il nome della proprietà da leggere.
Per ulteriori informazioni sull'esecuzione di query per gli eventi, vedere Procedura: eseguire query per eventi. Per ulteriori informazioni sulla sottoscrizione di eventi, vedere Procedura: sottoscrivere gli eventi in un registro eventi.
Esempio
Descrizione
Nell'esempio di codice riportato di seguito vengono eseguite query per tutti gli eventi di livello 2 nel registro applicazioni, quindi viene visualizzata la rappresentazione XML per ciascun evento. Ciascuna istanza di evento restituita dalla query eventi è rappresentata da un'istanza di un oggettoEventRecord. Il metodo ToXml viene chiamato per acquisire la rappresentazione XML dell'evento.
Codice
Imports System
Imports System.Text
Imports System.Diagnostics.Eventing.Reader
Imports System.Xml
Public Class ReadEventXmlExample
Public Overloads Shared Function Main( _
ByVal args() As String) As Integer
Dim logName As String = "Application"
Dim queryString As String = "*[System/Level=2]"
Dim eventsQuery As New EventLogQuery(logName, _
PathType.LogName, queryString)
Dim logReader As EventLogReader
Console.WriteLine("Querying the Application channel event log for all events...")
Try
' Query the log and create a stream of selected events
logReader = New EventLogReader(eventsQuery)
Catch e As EventLogNotFoundException
Console.WriteLine("Failed to query the log!")
Console.WriteLine(e)
Return 1
End Try
Dim numberOfEvents As Integer = 0
' For each event returned from the query
Dim eventInstance As EventRecord = logReader.ReadEvent()
While Not eventInstance Is Nothing
Dim eventXml As String = eventInstance.ToXml()
Console.WriteLine("Event " & (++numberOfEvents) & " : " & _
System.Environment.NewLine & eventXml)
Console.WriteLine("---------------------------------")
eventInstance = logReader.ReadEvent()
End While
End Function
End Class
using System;
using System.Text;
using System.Diagnostics.Eventing.Reader;
using System.Xml;
class ReadEventXmlExample
{
static void Main(string[] args)
{
String logName = "Application";
String queryString = "*[System/Level=2]";
EventLogQuery eventsQuery = new EventLogQuery(logName,
PathType.LogName, queryString);
EventLogReader logReader;
Console.WriteLine("Querying the Application channel event log for all events...");
try
{
// Query the log and create a stream of selected events
logReader = new EventLogReader(eventsQuery);
}
catch (EventLogNotFoundException e)
{
Console.WriteLine("Failed to query the log!");
Console.WriteLine(e);
return;
}
int numberOfEvents = 0;
// For each event returned from the query
for (EventRecord eventInstance = logReader.ReadEvent();
eventInstance != null;
eventInstance = logReader.ReadEvent())
{
String eventXml = eventInstance.ToXml();
Console.WriteLine("Event " + (++numberOfEvents) + " : " + System.Environment.NewLine + eventXml);
Console.WriteLine("---------------------------------");
//Console.ReadLine();
}
}
}
Compilazione del codice
Per questo esempio di codice sono necessari riferimenti ai file System.dll e System.Core.dll.
Esempio
Descrizione
Nell'esempio di codice riportato di seguito viene utilizzata la classe EventLogPropertySelector per eseguire il rendering di un'istanza di evento come un elenco di valori specificati. I valori specificati indicano l'utente che ha registrato l'evento, l'ora di creazione dell'evento, l'identificatore dell'evento e l'identificatore del record eventi.
Codice
Imports System
Imports System.Collections.Generic
Imports System.Text
Imports System.Diagnostics.Eventing.Reader
Public Class ReadEventValuesExample
Public Shared Function Main( _
ByVal args() As String) As Integer
Dim logName As String = "Application"
Dim queryString As String = "*[System/Level=2]"
Dim eventsQuery As New EventLogQuery(logName, _
PathType.LogName, queryString)
Dim logReader As EventLogReader
Console.WriteLine("Querying the Application channel event log for all events...")
Try
' Query the log
logReader = New EventLogReader(eventsQuery)
Catch e As EventLogNotFoundException
Console.WriteLine("Failed to query the log!")
Console.WriteLine(e)
Return 1
End Try
'''''''
' This section creates a list of XPath reference strings to select
' the properties that we want to display
' In this example, we will extract the User, TimeCreated, EventID and EventRecordID
'''''''
' Array of strings containing XPath references
Dim xPathRefs(3) As String
xPathRefs(0) = "Event/System/Security/@UserID"
xPathRefs(1) = "Event/System/TimeCreated/@SystemTime"
xPathRefs(2) = "Event/System/EventID"
xPathRefs(3) = "Event/System/EventRecordID"
' Place those strings in an IEnumberable object
Dim xPathEnum As IEnumerable(Of String) = xPathRefs
' Create the property selection context using the XPath reference
Dim logPropertyContext As New EventLogPropertySelector(xPathEnum)
Dim numberOfEvents As Integer = 0
' For each event returned from the query
Dim eventInstance As EventLogRecord = logReader.ReadEvent()
While Not eventInstance Is Nothing
Dim logEventProps As IList(Of Object)
Try
' Cast the EventRecord into an EventLogRecord to retrieve property values.
' This will fetch the event properties we requested through the
' context created by the EventLogPropertySelector
logEventProps = eventInstance.GetPropertyValues(logPropertyContext)
Console.WriteLine("Event {0} :", ++numberOfEvents)
Console.WriteLine("User: {0}", logEventProps(0))
Console.WriteLine("TimeCreated: {0}", logEventProps(1))
Console.WriteLine("EventID: {0}", logEventProps(2))
Console.WriteLine("EventRecordID : {0}", logEventProps(3))
' Event properties can also be retrived through the event instance
Console.WriteLine("Event Description:" + eventInstance.FormatDescription())
Console.WriteLine("MachineName: " + eventInstance.MachineName)
Catch e As Eventing.Reader.EventLogException
Console.WriteLine("Couldn't render event!")
Console.WriteLine("Exception: Event {0} may not have an XML representation \n\n", ++numberOfEvents)
Console.WriteLine(e)
End Try
eventInstance = logReader.ReadEvent()
End While
End Function
End Class
using System;
using System.Collections.Generic;
using System.Text;
using System.Diagnostics.Eventing.Reader;
class ReadEventValuesExample
{
static void Main(string[] args)
{
String logName = "Application";
String queryString = "*[System/Level=2]";
EventLogQuery eventsQuery = new EventLogQuery(logName,
PathType.LogName, queryString);
EventLogReader logReader;
Console.WriteLine("Querying the Application channel event log for all events...");
try
{
// Query the log
logReader = new EventLogReader(eventsQuery);
}
catch (EventLogNotFoundException e)
{
Console.WriteLine("Failed to query the log!");
Console.WriteLine(e);
return;
}
//////
// This section creates a list of XPath reference strings to select
// the properties that we want to display
// In this example, we will extract the User, TimeCreated, EventID and EventRecordID
//////
// Array of strings containing XPath references
String[] xPathRefs = new String[4];
xPathRefs[0] = "Event/System/Security/@UserID";
xPathRefs[1] = "Event/System/TimeCreated/@SystemTime";
xPathRefs[2] = "Event/System/EventID";
xPathRefs[3] = "Event/System/EventRecordID";
// Place those strings in an IEnumberable object
IEnumerable<String> xPathEnum = xPathRefs;
// Create the property selection context using the XPath reference
EventLogPropertySelector logPropertyContext = new EventLogPropertySelector(xPathEnum);
int numberOfEvents = 0;
// For each event returned from the query
for (EventRecord eventInstance = logReader.ReadEvent();
eventInstance != null;
eventInstance = logReader.ReadEvent())
{
IList<object> logEventProps;
try
{
// Cast the EventRecord into an EventLogRecord to retrieve property values.
// This will fetch the event properties we requested through the
// context created by the EventLogPropertySelector
logEventProps = ((EventLogRecord)eventInstance).GetPropertyValues(logPropertyContext);
Console.WriteLine("Event {0} :", ++numberOfEvents);
Console.WriteLine("User: {0}", logEventProps[0]);
Console.WriteLine("TimeCreated: {0}", logEventProps[1]);
Console.WriteLine("EventID: {0}", logEventProps[2]);
Console.WriteLine("EventRecordID : {0}", logEventProps[3]);
// Event properties can also be retrived through the event instance
Console.WriteLine("Event Description:" + eventInstance.FormatDescription());
Console.WriteLine("MachineName: " + eventInstance.MachineName);
}
catch (Exception e)
{
Console.WriteLine("Couldn't render event!");
Console.WriteLine("Exception: Event {0} may not have an XML representation \n\n", ++numberOfEvents);
Console.WriteLine(e);
}
}
}
}
Compilazione del codice
Per questo esempio sono necessari riferimenti ai file System.dll e System.Core.dll.
Vedere anche
Concetti
.gif)
Invia commenti su questo argomento a Microsoft.
Copyright © 2007 Microsoft Corporation. Tutti i diritti riservati.