Working with EventViewer using C#

There are several phases of a Application . It does not end with developing the application and deploying it on production servers. Other most important part, any problem surfaces after the deployment, how quickly the problem can be be resolved and according to severity of the issue (if required) a patch can be deployed on production. Apart from this, we also want to get notified on all the issues occurred on production and accordingly analyze and take care in future releases. We can also log other details that could be useful to check the status of Application.

Basics of Event Viewer

As we know that Windows operating system itself logs all the details in the event viewer. Whenever any problem occurs. We go directly to check the event viewer. The Event Log Service records application, security, and system events in Event Viewer. The same event viewer we can use to log the details of the our application. .NET provides a very friendly APIs to connect, log and read the event-viewer. In this post we’ll learn how we can use event-viewer for our applications.

Let’s have a look on Windows 8 event log viewer.

This screen got a new look and the whole events are grouped in four at high level as we can see in the screen shot. Custom Views contains custom views created by user. Windows log contains the event details windows operating system. If we go inner details it is divided in four categories. Application, Security, Setup , System, Forwarded events. These contains the details of as theirname suggested.  Another top level group named Applications and service logs contains the log details of several application installed on the machine like office, sql server. An application that is installed on the machine uses this group to create the event logs as already named a few. It becomes very easy to go there the event logs for any specific application.

Working with Event Viewer

Now let’s jump to demo.  We need to add the namespace System.Diagnostics to work on even-viewer. Also, there are five kind of events can be created in event viewer. These are

  1. information
  2. SuccessAudit
  3. Warning
  4. FailureAudit
  5. Error

Creating an Entry in Event Log

We can use these event type based on the type of entry that we are creating. So now let us create an entry in event log

// Create an EventLog instance and assign its source.
EventLog eventLog = new EventLog();
eventLog.Source = "NewSource";

// Write an entry in the event log.
eventLog.WriteEntry("This is a warning generated by the application.", EventLogEntryType.Warning, 1001);

In above code, we have created an instance of event log and assigned the source property with some source name. Then WriteEntry method is responsible to write an entry in event log. This method has many overloads. Here we have provided the message, event log type, eventId. We can provide just message but that will be of by-default type information. When we run the above code, it creates the entry as


Every event type has different icon as above we creates as warning.

But here if we see this has just created an entry that is visible under WindowsLog->System. But this certainly should not be part of it else we may face tough time while finding the events that are specific to our application. So we should create a separate group for our application and all the events should be part of that.

Creating an Entry in a new Event Log

So we need to create a new source and new log name. Then use this log for creating the entries. So let’s jump to write the code

// Create the source and log, if it does not already exist.
if (!EventLog.SourceExists("MySource"))
    EventLog.CreateEventSource("MySource", "MyNewLog");
// Create an EventLog instance and assign its source.
EventLog eventLog = new EventLog();
// Setting the source
eventLog.Source = "MySource";

// Write an entry to the event log.
eventLog.WriteEntry("An error has been generated by the application.", EventLogEntryType.Error, 1002);

Here if we checked if the source does exist, we created a source with log name. Then while creating the eventlog provided the same source and called the WriteEntry method. In this method, I provided the EventLogEntryType as error and the eventid that I gave is 1002. I have run the code and let’s see the event viewer again

newlogYes, anew error entry is created in a new log named MyNewLog that we provided while creating it. And here MyNewLog is created under Applications and service logs.

I have already created log entries of type error and warning. We have seen the icon is also different of these two. Similarly other type of entries can be created as well. Now let us see that How can we remove these form the log and even remove the log itself.

Clear Event Log

Clearing event log is very easy and we need to provide the source of the log to clear it. The code can be written as

EventLog eventLog = new EventLog();
// Setting the source
eventLog.Source = "MySource";

The above code removes all the entries from the log that we created MyNewLog.
Delete the Event Source

Delete the Event Source

To remove the source as

if (EventLog.SourceExists("MySource"))

The above code removes the source.

Delete the Log

Now to remove the log (As we created in this post MyNewLog) We can write the code as

if (EventLog.Exists("MyNewLog"))
// Delete Source

Similarly, there are other options available that can be used.

Reading Event Viewer

Now we have discussed create and edit operations. Now we will see that How can we read the existing logs . Many we might need to see the logs from the server as we might not have access to the server. So in those scenarios, we can read the logs.

EventLog myLog = new EventLog();
myLog.Log = "MyNewLog";
foreach (EventLogEntry entry in myLog.Entries)
    // Read event log entry details

The above code reads all the entries from the log named MyNewLog. The entry object contains all the information of that log entry.

Hope you all have enjoyed the Post. Do share your feedback


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s