2

I need to be able to retrieve event log entries for Hyper-V as part of a monitoring system we use. At the moment I use VBScript and WMI and do something like:

query = "Select * from Win32_NTLogEvent where LogFile = 'System' and TimeGenerated >= '" & last_check & "'"
set wmi_objectset = wmi_service.ExecQuery(query, "WQL", &h30)

and this works fine but it only retrieves some of the Hyper-V logs not all. Some Googling suggests that there is no way round this and MS have not built the ability to read all the Hyper-V logs into WMI. So I need a different approach.

More Googling found some C# code for reading the event logs and this will do fine as I am happy to use C# instead of VBScript. The trouble is that while I can read the standard logs like System and Application I can't work out how to read the Hyper-V log I want. The code looks like:

eventLog = new EventLog();
eventLog.Log = eventLogName;

foreach (EventLogEntry log in eventLog.Entries)
{

If I set eventLogName to "System" then it works and reads back all the log entries (and it's impressively quick). But what I need are the entries from the log Microsoft-Windows-Hyper-V-VMMS-Admin. If I set eventLogName to "Microsoft-Windows-Hyper-V-VMMS-Admin" I get an exception:

Unhandled Exception: System.InvalidOperationException: The event log 'Microsoft-Windows-Hyper-V-VMMS-Admin' on computer '.' does not exist.

The log does exist, and the PowerShell command:

Get-WinEvent -LogName Microsoft-Windows-Hyper-V-VMMS-Admin

does retrieve the events, so the problem is presumably just the right way to specify the log name for the EventLog object.

So my question is simply what to use in my C# program to get the entries in the Hyper-V VMMS Admin log.

The server I am testing on is 2012R2 though I don't think the problem is related to the exact version of Windows. There are other ways of getting at the log data, like Get-WinEvent or wevtutil, but I would much prefer to get the C# program to work and using an alternative method would be a last resort.

0

1 Answer 1

1
+100

This happens because System.Diagnostics.EventLog only supports "old style" event logs. The "new style" event logs are those you see in Event Viewer under "Applications and Services Logs" (and then the subfolders of that, not the ones directly in it), and it doesn't support reading those. To read those, you need to use the classes provided in System.Diagnostics.Eventing.Reader. Note that these have a different interface that is geared more towards real-time event retrieval. Sample code:

using (var reader = new EventLogReader("Microsoft-Windows-Hyper-V-VMMS-Admin")) {
    EventRecord eventRecord;
    while ((eventRecord = reader.ReadEvent()) != null) {
        Console.WriteLine("{0:s} {1}", eventRecord.TimeCreated, eventRecord.FormatDescription());
    }
}   

If you are specifically interested in the latest events, it's more efficient to query them in reverse order and filter them that way. With a little enumerator helper we can throw in LINQ:

IEnumerable<EventRecord> ReadEventsReverse(string logName) {
    using (
        var reader = new EventLogReader(
            new EventLogQuery(logName, PathType.LogName) { ReverseDirection = true }
        )
    ) {
        EventRecord eventRecord;
        while ((eventRecord = reader.ReadEvent()) != null) {
            yield return eventRecord;
        }
    }   
}

And then

var reverseEvents = ReadEventsReverse("Microsoft-Windows-Hyper-V-VMMS-Admin");
var reverseEventsToday = reverseEvents.TakeWhile(e => e.TimeCreated >= DateTime.Now.Date);
foreach (var eventRecord in reverseEventsToday) {
    Console.WriteLine("{0:s} {1}", eventRecord.TimeCreated, eventRecord.FormatDescription());
}

If you're specifically interested in reading new events, it's even more efficient to use the overload that allows you to supply a bookmark so you're not continuously re-reading and filtering old events.

1
  • It works! Thanks Jeroen :-) I had tried using EventLogQuery/EventLogReader but had obviously got the aruments wrong. Anyhow it's working now. Feb 2, 2016 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.