How to limit EventLog entries to one source?

Question

I'm using EventLog to support a logging class in my C# application. (Previously...) Here's a whittled down copy of that class:

class Logger
{
    private EventLog eventLog;
    private ListView listViewControl = null;
    private String logSource = "SSD1";

    public Logger(ListView _listViewControl = null, string _logFileName = null)
    {
        if (!EventLog.SourceExists("SSD1"))
            EventLog.CreateEventSource(logSource, "Application");
        eventLog = new EventLog();
        eventLog.Source = logSource;
        addListView(_listViewControl);
        logFilename = _logFileName;
    }

    public void addListView(ListView newListView)
    {
        if (eventLog.Entries.Count > 0)
        {
            foreach (EventLogEntry entry in eventLog.Entries)
            {
                listViewControl.Items.Add(buildListItem(entry));
            }
        }
    }

    public void LogInformation(string message)
    {
        LogEntry(message, EventLogEntryType.Information);
    }

    private void LogEntry(string message, EventLogEntryType logType)
    {
        eventLog.WriteEntry(message, logType);
        if (listViewControl != null)
        {
            updateListView();
        }
    }

    private void updateListView()
    {
        listViewControl.Items.Add(buildListItem(eventLog.Entries[eventLog.Entries.Count-1]));
    }

    private ListViewItem buildListItem(EventLogEntry entry)
    {
        string[] eventArray = new string[3];
        eventArray[0] = entry.Message + " (" + entry.Source +")";
        eventArray[1] = entry.EntryType.ToString();
        eventArray[2] = entry.TimeGenerated.ToString("dd/MM/yyyy - HH:mm:ss");
        return new ListViewItem(eventArray);
    }

The problem is, the ListView gets populated with the whole of the log - not just those from the specified source. Here's a screenshot of the output:

(In this image, the source of each entry is in brackets after the message.)

How do I get the EventLog to return only those entries from my source? Have I misunderstood EventLog completely?

Answer 1

I've never tried reading from the event log so not sure how it works with filtering them, but a suggestion would be that instead of writing your events to the Application log you could create your own log create a new log called SSD or something and then when you write/read it it'll only be your events in there.

Answer 2

The EventLog.Source member doesn't work as a filter. According to the MSDN documentation for EventLog

To read from a log, specify the Log name and MachineName (server computer name) for the EventLog. It is not necessary to specify the Source, as a source is required only for writing to logs. The Entries member is automatically populated with the event log's list of entries.

Because you do not specify a string for the Log member of the EventLog instance, it is getting everything.

Off the top of my head, there are a couple of ways to deal with this.

First, modify buildListItem() to filter on your source name. This is relatively straightforward.

Second, create your own log. Instead of logging to the Application log, create a log specifically for your application. You can do this by altering your constructor:

public Logger(ListView _listViewControl = null, string _logFileName = null)   
{   
    if (!EventLog.SourceExists("SSD1"))   
        EventLog.CreateEventSource("SSD1", "TomWrightApplication");   
    eventLog = new EventLog("TomWrightApplication", ".", "SSD1");
    addListView(_listViewControl);   
    logFilename = _logFileName;   
}   

All logging will now go to the TomWrightApplication log, not the generic Application log.

---

Tom, I've got a test project that simply does the following:

static void Main()
{
    if (!EventLog.SourceExists("SSD1"))
        EventLog.CreateEventSource("SSD1", "SSDAppLog");
    EventLog log = new EventLog("SSDAppLog", ".", "SSD1");
    log.WriteEntry("this is a test");
}

This works successfully unless...the SSD1 source name is already registered with another log. As I understand it, the source name must be unique across all event logs. So, if you've already registered SSD1 with the Application log, the above code will fail when creating the new EventLog. Try using the EventLog.DeleteEventSource() to remove the SSD1 source name from the Application log (just run this one time for your system). The above code should work then (assuming you have admin privileges).