I need to be able to retrieve event log entries for Hyper-V as part of a monitoring system we use. At the moment I use VBScript and WMI and do something like:
query = "Select * from Win32_NTLogEvent where LogFile = 'System' and TimeGenerated >= '" & last_check & "'"
set wmi_objectset = wmi_service.ExecQuery(query, "WQL", &h30)
and this works fine but it only retrieves some of the Hyper-V logs not all. Some Googling suggests that there is no way round this and MS have not built the ability to read all the Hyper-V logs into WMI. So I need a different approach.
More Googling found some C# code for reading the event logs and this will do fine as I am happy to use C# instead of VBScript. The trouble is that while I can read the standard logs like System and Application I can't work out how to read the Hyper-V log I want. The code looks like:
eventLog = new EventLog();
eventLog.Log = eventLogName;
foreach (EventLogEntry log in eventLog.Entries)
{
If I set eventLogName to "System" then it works and reads back all the log entries (and it's impressively quick). But what I need are the entries from the log Microsoft-Windows-Hyper-V-VMMS-Admin. If I set eventLogName to "Microsoft-Windows-Hyper-V-VMMS-Admin" I get an exception:
Unhandled Exception: System.InvalidOperationException: The event log 'Microsoft-Windows-Hyper-V-VMMS-Admin' on computer '.' does not exist.
The log does exist, and the PowerShell command:
Get-WinEvent -LogName Microsoft-Windows-Hyper-V-VMMS-Admin
does retrieve the events, so the problem is presumably just the right way to specify the log name for the EventLog object.
So my question is simply what to use in my C# program to get the entries in the Hyper-V VMMS Admin log.
The server I am testing on is 2012R2 though I don't think the problem is related to the exact version of Windows. There are other ways of getting at the log data, like Get-WinEvent or wevtutil, but I would much prefer to get the C# program to work and using an alternative method would be a last resort.