locked
C# Windows event log custom data RRS feed

  • Question

  • I would like to add custom data into the Windows event log message as formatted text (XML string) . Whatever I add, gets added as strings and are shown with the XML tags. Is there a recommended way to add custom data to the log entry? A typical log entry looks like this:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
     <System>
            ...
     </System>
     <EventData>
      <Data>3031358440</Data> 
      <Data>5</Data> 
      <Data>WindowsUpdateFailure</Data> 
      <Data>Not available</Data> 
     </EventData>
    </Event>

    I would like to add data like this:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
     <System>
            ...
     </System>
     <EventData>
      <Data>
        <ThreadID/>
        <AssignedPriority/>
      </Data>
     </EventData>
    </Event>



    Thursday, November 15, 2012 12:14 PM

Answers

  • Thank you all for the suggestions. Since I didn't get a clear answer (in this thread and elsewhere), i assume that the only way is to format the strings in XML format myself.
    Tuesday, November 20, 2012 8:09 AM

All replies

  • Do you want to add that data inside the existing log dile?

    If so you have to know the structure of that XML file. You have to know what you have to add inside each node of the document. 

    Can I ask you why do you want to do that?

    Friday, November 16, 2012 10:42 AM
  • I would log new events and the data should be part of the new event logs. I know the data that has to be added to each node under <Data>.

    Why am I doing this: I would like to pass more details than the current event log properties. I can pass as text under <Data>. But, I feel its better if I can pass formatted data. The additional props will be used by a log analyzer.

    Friday, November 16, 2012 3:38 PM
  • I can't remember if event logs are in format .txt. If it is, you should create a new log with class that is for that (StreamWritter or something like that). Also I believe that you have to create that log in the right path so View Event Logs (that's the name in Windows 8) can read it.

    If you have experience with XML than this should not be a problem to do.

    Friday, November 16, 2012 4:14 PM
  • There is a wrapper class called EventLog that I believe you could just pass a string that is xml to the WriteEvent. I can't really test this now (since Im at work. Ill try later tonight) but it might work. The work case is that it would escape the xml characters or reject the message :).

    Thanks,

    Brad

    Friday, November 16, 2012 5:26 PM
  • @Guys: thanks for the answers. I can write an XML string directly using WriteEntry method. The problem is that they appear like this:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
     <EventData>
      <Data><ThreadID>2<ThreadID></Data>
      <Data><AssignedPriority>Normal</AssignedPriority></Data>
     </EventData>
    </Event>

    What I would like to have is like this:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
     <EventData>
      <Data>
        <ThreadID>2<ThreadID>
        <AssignedPriority>Normal</AssignedPriority>
      </Data>
     </EventData>
    </Event>


    • Edited by Ajesh John Monday, November 19, 2012 7:20 AM
    Monday, November 19, 2012 7:19 AM
  • You might just have to put newline(\n) and tab (\t) characters in if you wanted to format it nicely.

    Thanks,

    Brad

    Monday, November 19, 2012 2:46 PM
  • Thank you all for the suggestions. Since I didn't get a clear answer (in this thread and elsewhere), i assume that the only way is to format the strings in XML format myself.
    Tuesday, November 20, 2012 8:09 AM