Although applications are more likely to write to than read the event log, sometimes an application will read the event log. The EventLog.Entries property returns an EventLogEntryCollection containing EventLogEntry instances. Each EventLogEntry represents a single event log record and provides the properties detailed in Table A-9 to access the details of the event.

When an application reads from a log, the Source doesn’t need to be specified; only the Log and MachineName properties are required. Changing the Log and MachineName properties of an existing EventLog instance provides access to the newly specified log.

The following example opens the Application log on the local machine and counts the events generated by the source MyApp:

using System;
using System.Diagnostics;

public class EventLogReader {

    public static void Main() {

        // Create the EventLog instance and open the
        // "Application" log
        EventLog log = new EventLog("Application");

        // Get the collection of log entries
        EventLogEntryCollection entries = log.Entries;

        // Declare a counter
        int count = 0;

        // Loop through the entries and count occurrences for
        // the "MyApp" source
        foreach (EventLogEntry entry in entries) {
            if (entry.Source == "MyApp") count++;
        }

        // Display count information for the source to the console
        Console.WriteLine("Logged events for MyApp = {0}", count);
    }
}

There is no method to explicitly create a new log; if a source is registered against a log that doesn’t exist, calls to the WriteEntry method will cause the log to be created automatically. The following statements show two distinct approaches to creating the MyApplicationLog log using a source named MySrc (assuming the log doesn’t already exist):

// Using an EventLog instance
EventLog e = new EventLog("MyApplicationLog", ".", "MySrc");
e.WriteEntry("A test message");

// Using EventLog static methods
EventLog.CreateEventSource("MySrc", "MyApplicationLog");
EventLog.WriteEntry("MySrc", "A test message");

The existence of a log is determined using the static EventLog.Exists method, passing it a String argument containing the name of the log to test for. An overloaded version also accepts a machine name for testing the existence of a log on a remote machine.

The static EventLog.Delete method accepts the same arguments as Exists but deletes the specified log if it exists; if the log doesn’t exist, a System.SystemException is thrown.

Applications can use the EventLog.EntryWritten event to be notified when entries are written to the event log of the local computer; notifications from remote computers are not supported.

First an EventLog instance is created and mapped to a specific log. Second the EnableRaisingEvents property is set to true; this enables event notifications on the EventLog instance. Finally the EventLog.EntryWritten event is provided with an event handler delegate to be notified when event log entries are written. The delegate that defines the EntryWritten event handler has the following signature:

public delegate void EntryWrittenEventHandler(object sender,
    EntryWrittenEventArgs e);

The sender argument is the EventLog instance that raised the event, and e is a System.Diagnostics.EntryWrittenEventArgs instance; EntryWrittenEventArgs contains an Entry property that gets an EventLogEntry representing the event log entry that caused the event to be raised.

The following example program listens to the Application event log and displays summary details to the console each time an entry is written:

using System;
using System.Diagnostics;

public class EventLoglListener {

    public static void Main() {

        // Create the EventLog instance and open the
        // "Application" log
        EventLog log = new EventLog("Application",
            ".", "testapp");

        // Enable event notifications
        log.EnableRaisingEvents = true;

        // Create the event handler
        log.EntryWritten +=
            new EntryWrittenEventHandler(EventLogEventHandler);

        // Make sure the process does not terminate
        Console.ReadLine();
    }

    public static void EventLogEventHandler(object sender,
           EntryWrittenEventArgs arg) {
        // Get the EventLogEntry that triggered the event
        EventLogEntry entry = arg.Entry;

        // Display summary information for the event to
        // the console
        Console.WriteLine(
            "{0}:Category {1} event triggered by {2}",
            entry.TimeWritten, entry.CategoryNumber,
            entry.Source);
    }
}

If we run the previous EventLogWriter example while the EventLogListener example is running, we get output similar to the following:

02/04/2002 15:04:06:Category 0 event triggered by MyApp
02/04/2002 15:04:11:Category 0 event triggered by MyApp
02/04/2002 15:04:16:Category 0 event triggered by MyApp
02/04/2002 15:04:21:Category 0 event triggered by MyApp