EventLog.GetEventLogs 方法
定义
重要
一些信息与预发行产品相关，相应产品在发行之前可能会进行重大修改。 对于此处提供的信息，Microsoft 不作任何明示或暗示的担保。
创建事件日志的数组。
重载
| GetEventLogs(String) |
在给定计算机上搜索所有事件日志并创建一个包含该列表的 EventLog 对象数组。 |
| GetEventLogs() |
在本地计算机上搜索所有的事件日志并创建一个包含该列表的 EventLog 对象数组。 |
GetEventLogs(String)
- Source:
- EventLog.cs
- Source:
- EventLog.cs
- Source:
- EventLog.cs
在给定计算机上搜索所有事件日志并创建一个包含该列表的 EventLog 对象数组。
public:
static cli::array <System::Diagnostics::EventLog ^> ^ GetEventLogs(System::String ^ machineName);public static System.Diagnostics.EventLog[] GetEventLogs (string machineName);static member GetEventLogs : string -> System.Diagnostics.EventLog[]Public Shared Function GetEventLogs (machineName As String) As EventLog()参数
- machineName
- String
在其上搜索事件日志的计算机。
返回
EventLog[]
EventLog 类型的数组，表示给定计算机上的日志。
例外
machineName 参数是无效的计算机名称。
示例
以下示例获取计算机“myServer”上的日志列表。 然后输出每个日志的名称。
#using <System.dll>
using namespace System;
using namespace System::Diagnostics;
using namespace System::Threading;
int main()
{
array<EventLog^>^remoteEventLogs;
remoteEventLogs = EventLog::GetEventLogs( "myServer" );
Console::WriteLine( "Number of logs on computer: {0}", remoteEventLogs->Length );
System::Collections::IEnumerator^ myEnum = remoteEventLogs->GetEnumerator();
while ( myEnum->MoveNext() )
{
EventLog^ log = safe_cast<EventLog^>(myEnum->Current);
Console::WriteLine( "Log: {0}", log->Log );
}
}
using System;
using System.Diagnostics;
class MySample
{
public static void Main()
{
EventLog[] remoteEventLogs;
remoteEventLogs = EventLog.GetEventLogs("myServer");
Console.WriteLine("Number of logs on computer: " + remoteEventLogs.Length);
foreach (EventLog log in remoteEventLogs)
{
Console.WriteLine("Log: " + log.Log);
}
}
}
Imports System.Diagnostics
Imports System.Threading
Class MySample
Public Shared Sub Main()
Dim remoteEventLogs() As EventLog
remoteEventLogs = EventLog.GetEventLogs("myServer")
Console.WriteLine(("Number of logs on computer: " & remoteEventLogs.Length))
Dim log As EventLog
For Each log In remoteEventLogs
Console.WriteLine(("Log: " & log.Log))
Next log
End Sub
End Class
注解
对象的数组EventLog是调用 GetEventLogs 时由 machineName 参数指定的计算机上所有事件日志的快照。 这不是动态集合，因此它不会实时反映日志的删除或创建。 在读取或写入数组之前，应验证该数组中的日志是否存在。 数组通常至少包含三个日志：应用程序、系统和安全。 如果在指定的计算机上创建了自定义日志，则它们也将显示在 数组中。
GetEventLogs 是一个 static 方法，因此可以对类本身调用 EventLog 它。 无需创建 对象的实例 EventLog 来调用 方法。
若要检索事件日志列表，必须具有相应的注册表权限。 这些权限与调用 Exists 和 SourceExists所需的权限相同。
另请参阅
适用于
GetEventLogs()
- Source:
- EventLog.cs
- Source:
- EventLog.cs
- Source:
- EventLog.cs
在本地计算机上搜索所有的事件日志并创建一个包含该列表的 EventLog 对象数组。
public:
static cli::array <System::Diagnostics::EventLog ^> ^ GetEventLogs();public static System.Diagnostics.EventLog[] GetEventLogs ();static member GetEventLogs : unit -> System.Diagnostics.EventLog[]Public Shared Function GetEventLogs () As EventLog()返回
EventLog[]
EventLog 类型的数组，表示本地计算机上的日志。
例外
示例
以下示例枚举在本地计算机上定义的事件日志，并显示每个事件日志的配置详细信息。
void DisplayEventLogProperties()
{
// Iterate through the current set of event log files,
// displaying the property settings for each file.
array<EventLog^>^eventLogs = EventLog::GetEventLogs();
System::Collections::IEnumerator^ myEnum = eventLogs->GetEnumerator();
while ( myEnum->MoveNext() )
{
EventLog^ e = safe_cast<EventLog^>(myEnum->Current);
Int64 sizeKB = 0;
Console::WriteLine();
Console::WriteLine( "{0}:", e->LogDisplayName );
Console::WriteLine( " Log name = \t\t {0}", e->Log );
Console::WriteLine( " Number of event log entries = {0}", e->Entries->Count );
// Determine if there is a file for this event log.
RegistryKey ^ regEventLog = Registry::LocalMachine->OpenSubKey( String::Format( "System\\CurrentControlSet\\Services\\EventLog\\{0}", e->Log ) );
if ( regEventLog )
{
Object^ temp = regEventLog->GetValue( "File" );
if ( temp != nullptr )
{
Console::WriteLine( " Log file path = \t {0}", temp );
FileInfo^ file = gcnew FileInfo( temp->ToString() );
// Get the current size of the event log file.
if ( file->Exists )
{
sizeKB = file->Length / 1024;
if ( (file->Length % 1024) != 0 )
{
sizeKB++;
}
Console::WriteLine( " Current size = \t {0} kilobytes", sizeKB );
}
}
else
{
Console::WriteLine( " Log file path = \t <not set>" );
}
}
// Display the maximum size and overflow settings.
sizeKB = e->MaximumKilobytes;
Console::WriteLine( " Maximum size = \t {0} kilobytes", sizeKB );
Console::WriteLine( " Overflow setting = \t {0}", e->OverflowAction );
switch ( e->OverflowAction )
{
case OverflowAction::OverwriteOlder:
Console::WriteLine( "\t Entries are retained a minimum of {0} days.", e->MinimumRetentionDays );
break;
case OverflowAction::DoNotOverwrite:
Console::WriteLine( "\t Older entries are not overwritten." );
break;
case OverflowAction::OverwriteAsNeeded:
Console::WriteLine( "\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry." );
break;
default:
break;
}
}
}
static void DisplayEventLogProperties()
{
// Iterate through the current set of event log files,
// displaying the property settings for each file.
EventLog[] eventLogs = EventLog.GetEventLogs();
foreach (EventLog e in eventLogs)
{
Int64 sizeKB = 0;
Console.WriteLine();
Console.WriteLine("{0}:", e.LogDisplayName);
Console.WriteLine(" Log name = \t\t {0}", e.Log);
Console.WriteLine(" Number of event log entries = {0}", e.Entries.Count.ToString());
// Determine if there is an event log file for this event log.
RegistryKey regEventLog = Registry.LocalMachine.OpenSubKey("System\\CurrentControlSet\\Services\\EventLog\\" + e.Log);
if (regEventLog != null)
{
Object temp = regEventLog.GetValue("File");
if (temp != null)
{
Console.WriteLine(" Log file path = \t {0}", temp.ToString());
FileInfo file = new FileInfo(temp.ToString());
// Get the current size of the event log file.
if (file.Exists)
{
sizeKB = file.Length / 1024;
if ((file.Length % 1024) != 0)
{
sizeKB++;
}
Console.WriteLine(" Current size = \t {0} kilobytes", sizeKB.ToString());
}
}
else
{
Console.WriteLine(" Log file path = \t <not set>");
}
}
// Display the maximum size and overflow settings.
sizeKB = e.MaximumKilobytes;
Console.WriteLine(" Maximum size = \t {0} kilobytes", sizeKB.ToString());
Console.WriteLine(" Overflow setting = \t {0}", e.OverflowAction.ToString());
switch (e.OverflowAction)
{
case OverflowAction.OverwriteOlder:
Console.WriteLine("\t Entries are retained a minimum of {0} days.",
e.MinimumRetentionDays);
break;
case OverflowAction.DoNotOverwrite:
Console.WriteLine("\t Older entries are not overwritten.");
break;
case OverflowAction.OverwriteAsNeeded:
Console.WriteLine("\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry.");
break;
default:
break;
}
}
}
Shared Sub DisplayEventLogProperties()
' Iterate through the current set of event log files,
' displaying the property settings for each file.
Dim eventLogs As EventLog() = EventLog.GetEventLogs()
Dim e As EventLog
For Each e In eventLogs
Dim sizeKB As Int64 = 0
Console.WriteLine()
Console.WriteLine("{0}:", e.LogDisplayName)
Console.WriteLine(" Log name = " + ControlChars.Tab _
+ ControlChars.Tab + " {0}", e.Log)
Console.WriteLine(" Number of event log entries = {0}", e.Entries.Count.ToString())
' Determine if there is an event log file for this event log.
Dim regEventLog As RegistryKey
regEventLog = Registry.LocalMachine.OpenSubKey( _
("System\CurrentControlSet\Services\EventLog\" + e.Log))
If Not (regEventLog Is Nothing) Then
Dim temp As Object = regEventLog.GetValue("File")
If Not (temp Is Nothing) Then
Console.WriteLine(" Log file path = " + ControlChars.Tab _
+ " {0}", temp.ToString())
Dim file As New FileInfo(temp.ToString())
' Get the current size of the event log file.
If file.Exists Then
sizeKB = file.Length / 1024
If file.Length Mod 1024 <> 0 Then
sizeKB += 1
End If
Console.WriteLine(" Current size = " + ControlChars.Tab _
+ " {0} kilobytes", sizeKB.ToString())
End If
Else
Console.WriteLine(" Log file path = " + ControlChars.Tab _
+ " <not set>")
End If
End If
' Display the maximum size and overflow settings.
sizeKB = e.MaximumKilobytes
Console.WriteLine(" Maximum size = " + ControlChars.Tab _
+ " {0} kilobytes", sizeKB.ToString())
Console.WriteLine(" Overflow setting = " + ControlChars.Tab _
+ " {0}", e.OverflowAction.ToString())
Select Case e.OverflowAction
Case OverflowAction.OverwriteOlder
Console.WriteLine(ControlChars.Tab + _
" Entries are retained a minimum of {0} days.", _
e.MinimumRetentionDays)
Case OverflowAction.DoNotOverwrite
Console.WriteLine(ControlChars.Tab + _
" Older entries are not overwritten.")
Case OverflowAction.OverwriteAsNeeded
Console.WriteLine(ControlChars.Tab + _
" If number of entries equals max size limit, a new event log entry overwrites the oldest entry.")
Case Else
End Select
Next e
End Sub
注解
对象的数组EventLog是调用 GetEventLogs 时本地计算机上所有事件日志的快照。 这不是动态集合，因此它不会实时反映日志的删除或创建。 在读取或写入数组之前，应验证该数组中的日志是否存在。 数组通常至少包含三个日志：应用程序、系统和安全。 如果在本地计算机上创建了自定义日志，则它们也将显示在 数组中。
若要检索事件日志列表，必须具有相应的注册表权限。 这些权限与调用 Exists 和 SourceExists所需的权限相同。
