System.Diagnostics.EventLog doesn't contain correct message

PawZaw

In some cases, when retrieving event logs from System.Diagnostics.EventLog, message like this

The description for Event ID '10016' in Source 'DCOM' cannot be found...

is returned. I found out that this response is also returned by Get-EventLog command in Powershell.

The actual message should look like this:

The application-specific permission settings do not grant Local Activation permission...

and is returned by Get-WinEvent command.

Is there any way to retrieve the second message in .Net Framework project? (without calling an independent Powershell script)?

UPDATE

I implemented the suggested solution, but now I stumbled on a different problem - how can I retrieve Audit Success and Audit Failure information? The EventLogEntry had an enum that contained them, but EventRecord doesn't

Update 2

I found a way to deal with Audits. EventRecord has a Keywords property, I compared it to StandardEventKeywords enum

Mathias R. Jessen

As mentioned in the comments, Get-WinEvent uses the EventLogReader class to enumerate the events queried, and then calls EventRecord.FormatDescription() on each resulting record to render the localized message.

Here's a sample console application to fetch and print the rendered message of each of the first 10 Warning (Level=3) events in the Application log:

using System;
using System.Diagnostics.Eventing.Reader;

class Program
{
    static void Main(string[] args)
    {
        // construct an EventLogQuery object from a log path + xpath query
        var xpath = "*[System[Level=3]]";
        var query = new EventLogQuery("Application", PathType.LogName, xpath);

        // instantiate an EventLogReader over the query
        var reader = new EventLogReader(query);

        // read the events one by one
        var counter = 0;
        EventRecord record = null;
        while ((record = reader.ReadEvent()) is EventRecord && ++counter <= 10)
        {
            // call FormatDescription() to render the message in accordance with your computers locale settings
            var renderedMessage = record.FormatDescription();
            Console.WriteLine(renderedMessage);
        }
    }
}

Beware that it's entirely possible for FormatDescription() to return an empty string - this will occur when the event logging provider didn't provide a message template for the given event id.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

System.Diagnostics.EventLog.dll assembly not on machine and .NET Framework is installed

Optimizing a LINQ reading from System.Diagnostics.EventLog

System.Diagnostics.EventLog Cannot be Accessed with an Instance Reference

Is it possible to check if a message doesn't contain "ew" it deletes the message?

System monitor doesn't provide correct information

Correct hostname doesn't change in entire system

React-Native: Workspace doesn't contain correct schema

gitlab rule if commit message doesn't contain WIP

Logback pattern - do replace if message doesn't contain a word

returned express err object doesn't contain err.message

Xamarin Studio: Cannot copy System.Diagnostics.Tools.dll, as the source file doesn't exist

System.Diagnostics.Process.Start doesn't work in Default.aspx.cs

Timer doesn't contain in System.Threading at Xamarin.Forms

System.RuntimeType doesn't contain a definition for Declared Properties

System.Diagnostics.Trace - correct way to log exceptions

System.Diagnostics ServiceModel message logging not working for integration test project

Os.system doesn't push message in cron alert to cronitor?

Browsing "Senders" in Finder also returns code that doesn't contain the message I'm searching for in Pharo?

Error 'System.Diagnostics.Process' does not contain a definition for 'GetProcesses' in visual studio 2008 c#

IConfiguration doesn't contain AppSettings

Doesn't contain regex in elasticsearch

Can't register listeners to System.Diagnostics.Tracing.EventSource

my project can't use System.Diagnostics.Process

FTP transfer code fails with "[System.IO.FileStream] doesn't contain a method named "CopyTo""

Why doesn't Windows 7 Ultimate (64-bit) contain folder system64 like system32 in xp?

Windows Command | Split A File to Contain and Doesn't Contain By Other File

Why doesn't c program print error message to stderr when system call fails?

Method invocation failed because [System.Management.Automation.PSObject] doesn't contain a method named 'op_Addition'

Javascript match for string that doesn't contain a character