CODEWITHSUNDEEP
c#asp.neteventslogging
user175084
user175084

Reputation: 4630

EventLog bug in reading value of logEntry.EntryType

i have a code to get the information from eventlogs.

  protected void Page_Load(object sender, EventArgs e)
    {
   EventLog eventLog = new EventLog("Application", ".");

   getEvents(eventLog.Entries);
     }


private void getEvents(EventLogEntryCollection  eventLogEntryCollection)
    {

        foreach (EventLogEntry logEntry in eventLogEntryCollection)
        {                
            if (logEntry.Source.Equals("yen"))
            {
                eventType.Add(logEntry.EntryType.ToString());
                eventTime.Add(logEntry.TimeWritten);
                eventSource.Add(logEntry.Source);
                eventCategory.Add(logEntry.Category);
                eventID.Add(logEntry.EventID);
                eventMsg.Add(logEntry.Message.ToString());
                Global.logger.Info("Level = " + logEntry.EntryType.ToString() + ", eventTime = " + logEntry.TimeWritten);
            }
        }
    }

so the logEntry.EntryType.ToString() sometimes returns me Information, Error, Warning and sometimes just a 0. what is this 0 for??

Please any suggestions

the logs show this:

INFO 01-Jun-2011 11:48:18.SSS 8 .Global - Level = Information, eventTime = 5/20/2011 3:19:08 PM INFO 01-Jun-2011 11:48:18.SSS 8 .Global - Level = 0, eventTime = 5/20/2011 3:19:16 PM

Upvotes: 0

Views: 608

Answers (2)

user10101
user10101

Reputation: 1764

The System.Diagnostics.EventLogEntryType enumumerations defines five values: Error, FailureAudit, Information, SuccessAudit and Warning. But if you take a look to the documentation to native WinAPI ReportEvent function you will see there are actually six types of events. The event with code 0 is EVENTLOG_SUCCESS which have the same description as EVENTLOG_INFORMATION_TYPE. It is also displayed the same as "Information" by the Event Viewer.

So probably logEntry.EntryType.ToString() == "0" means that the event was logged with type of EVENTLOG_SUCCESS.

Upvotes: 0

Alois Kraus
Alois Kraus

Reputation: 13535

This can only happen if your eventlog is somehow corrupt. What does happen when you try to view this event with the eventvwr.msc? I have seen many corrupt event logs. This does usually happen when many events are logged at the same time. I never have found a clear repro but this does happen even on Windows Server 2008 from time to time although the whole eventlog subsystem has been rewritten.

Upvotes: 1

Related Questions