In .net what are the difference between Eventlog and ManagementObject for retriving logs from remote server?

Question

I have found out following two ways for getting Application Event log entries from remote server.

1. Using EventLog object

 string logType = "Application";
 EventLog ev = new EventLog(logType,"rspl200");

 EventLogEntryCollection evColl =  ev.Entries

2. Using ManagementObjectSearcher object

ConnectionOptions co = new ConnectionOptions(); co.Username = "testA"; co.Password = "testA"; ManagementScope scope = new ManagementScope(@"\" + "machineName"+ @"\root\cimv2", co); scope.Connect();

SelectQuery query = new SelectQuery(@"select * from Win32_NtLogEvent"); EnumerationOptions opt = new EnumerationOptions(); opt.BlockSize = 1000;

using (ManagementObjectSearcher searcher = new  ManagementObjectSearcher(scope, query,opt))
   {

     foreach (ManagementObject mo in searcher.Get())
                {

                       // write down log entries
                       Console.Writeline(mo["EventCode"]);

                }

   }

I can easily get remote eventlog using method #1 (Using EventLog object) without any security access denied exception. But using method #2 (Using ManagementObjectSearcher object) i get access denied exception.

Actually I want remote event log (only application and also latest log not all application logs) to be displayed in treeview like below

 -  ServerName
   - Logs
     + Error
     + Information
     + Warning

Can anybody help me in this to find out best way from this or any other?

Also the main thing is that user who reads remote logs may be in different domain than server.

Thanks Mitesh Patel

Answer 1

I see this is an old post...

I think your only problem with #2 is that your scope should be:

ManagementScope scope = new ManagementScope(@"\\" + "machineName"+ @"\root\cimv2", co);

You are missing the double backslash in yours.

One thing to be aware of using method #2 is that it's executing wmi queries so the wmi host process on the remote machine will get hammered. From what I've seen it runs at like %45 CPU usage till the wmi query completes.

I don't know how method #1 is implemented so can't say for sure on that.

If you're worried about performance I would stay away from the .Net event log API and use the win32 api(s):

pre-vista/2008: http://msdn.microsoft.com/en-us/library/aa363657(v=VS.85).aspx

post-vista/2008: http://msdn.microsoft.com/en-us/library/aa385785(v=VS.85).aspx