CODEWITHSUNDEEP
c#.netwindowspowershellevent-viewer
Daniel Arant
Daniel Arant

Reputation: 494

Why does new custom event log returned by EventLog.GetEventLogs contain Application log entries?

I have a very strange issue that doesn't seem to correspond to any of the documentation I'm reading about EventLog.GetEventLogs.

I created a new custom log using Powershell (a very straightforward operation) which contains zero entries. However, when I call EventLog.GetEventLogs and locate the new log in the resulting array, the Entries property contains all of the Application log entries. I was expecting the number of entries to be zero, which is what I see in the event viewer.

What could cause this result?

PowerConsole:

> New-EventLog
> Log Name? MyModule
> Souce Name 1? MyModule
> Source Name 2?

C# Code:

var logs = EventLog.GetEventLogs();
var log = logs.FirstOrDefault(l => l.Log == "MyModule");

Response.Write(log.Entries.Count); // Outputs 18,896

Upvotes: 0

Views: 226

Answers (2)

Daniel Arant
Daniel Arant

Reputation: 494

I found a solution. The PowerShell command that creates new logs ultimately modifies the registry. I'm guessing that some of those registry settings don't get applied until some other command is executed. After restarting my machine, EventLog.GetEvenLogs produced the expected results.

Upvotes: 0

Brendan Green
Brendan Green

Reputation: 11914

I think you may be looking at the wrong method.

Rather than calling GetEventLogs, get a reference to your custom log, and then look at it's entries:

EventLog myLog = new EventLog("my_log");           
var count = myLog.Entries.Count;

If we then write an entry like this:

EventLog myLog = new EventLog("my_log");
myLog.Source = "my_source";
myLog.WriteEntry("A test entry");

The count will increase as expected.

Upvotes: 1

Related Questions