Clever Geek Handbook

Programmatically create a custom Eventlog view

I want to programmatically create a custom Eventlog view in a C # application.

Here's how to create a custom Eventlog view using the Eventlog app from Microsoft Windows:

create custom view

I was looking for a class System.Diagnostics.EventLog

for a method that does the same as the button found in Microsoft's Eventlog app. Unfortunately, I couldn't find any functionality that covered my needs.

Has anyone ever programmed to create a custom Eventlog view in C # or know a way that works?

+3


source to share


2 answers


If just tested the approach here :

try
{
    XmlTextWriter view = new XmlTextWriter("C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\View_1.xml", Encoding.Unicode);
    // Root.
    view.WriteStartDocument();
    view.WriteStartElement("ViewerConfig");
    //Create Node for queryConfig
    view.WriteStartElement("QueryConfig");
    view.WriteStartElement("QueryParams");
    view.WriteStartElement("UserQuery");
    view.WriteEndElement();
    view.WriteEndElement();
    //QueryNode
    view.WriteStartElement("QueryNode");
    //....

    view.Close();
}
catch (XmlException ex)
{
    Console.WriteLine(ex.StackTrace);
}

This created a custom view for me. enter image description here



Basically, custom views are xml files stored in C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\

, and you can simply collapse them yourself by creating an XML document.

If you would like to know how to format such an XML document, you can always return to the already programmed queries in the Server Roles folder under C:\ProgramData\Microsoft\Event Viewer\Views\ServerRoles

+4


source


Possible Solution:



  • Create the desired custom look using the interface eventvwr.msc

    (displayed in the image you provided).
  • Export it to an .xml file and study / do a little research on its structure.
  • Write the code to generate such an XML file based on your needs, or use the already processed and exported only replacement appropriate "placeholders" (event codes, event sources, etc.).
  • Run eventvwr.exe

    with a parameter /v

    like eventvwr.exe /v:MyView.xml

    (more parameters with eventvwr.exe /?

    )
+1


source






More articles:


All Articles