Re: Is there a way to query Security Event Log with Filter in C#?

"Pucca" <Pucca@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:781462FF-AAFB-4197-9942-3FE17C6CDF23@xxxxxxxxxxxxxxxx
The odd thing is that it works when I change the logfile = 'Application'.
Wieht Security it retrievs 0 entry. Why is that so? I did verify that I
have over 55k of entries in Security log in Event Viewer.


--
Thanks.


"Pucca" wrote:

Thanks Peter. I tried it in my code but it's just exiting when it eaches the
statement mos.get(). Can you see what's wrong here? Also, where can I look
up syntax format and the properties names for the Security log? Thanks.

private void GetLog()
{
//string SomeDateTime = "20060101000000.000000+000";
//string Query = String.Format("SELECT * FROM Win32_NTLogEvent WHERE
Logfile = 'Security' AND TimeGenerated > '{0}'", SomeDateTime);
string Query = String.Format("SELECT * FROM Win32_NTLogEvent WHERE
Logfile = 'Security'");

object o;
string name;
try
{
ManagementObjectSearcher mos = new ManagementObjectSearcher(Query);
foreach (ManagementObject mo in mos.Get())
{
foreach (PropertyData pd in mo.Properties)
{
o = mo[pd.Name];
if (o != null)
{

//Console.WriteLine(String.Format("{0}: {1}", pd.Name,
mo[pd.Name].ToString()));
}
}
}
mos.Dispose();
}
catch (Exception e)
{
MessageBox.Show(e.Message);
}


}
--
Thanks.


"Petar Repac" wrote:

> Hi !
>
> You can try WMI query for this.
> Example that filters event log by LogFile and TimeGenerated.
>
> using System;
> using System.Collections.Generic;
> using System.Text;
> using System.Management;
>
> namespace QueryEventLog {
>
> class Program {
> static void Main(string[] args) {
> string SomeDateTime = "20070101000000.000000+000";
> string Query = String.Format("SELECT * FROM Win32_NTLogEvent
> WHERE Logfile = 'Application' AND TimeGenerated > '{0}'", SomeDateTime);
> ManagementObjectSearcher mos = new ManagementObjectSearcher(Query);
> object o;
>
> foreach (ManagementObject mo in mos.Get()) {
>
> Console.WriteLine("///////////////////////////////////////////////////////////////////////////");
> foreach (PropertyData pd in mo.Properties) {
> o = mo[pd.Name];
> if (o != null) {
> Console.WriteLine(String.Format("{0}: {1}", pd.Name,
> mo[pd.Name].ToString()));
> }
> }
> }
>
> Console.ReadLine();
> }
> }
> }
>
> Hope it helps.
>
> Petar Repac
>
>
>
> Pucca wrote:
> > Thank you Jani. I'm already using the eventLog class and processing each log
> > entry and filtering them in my C# code (vs2005, .net2.0) and then place the
> > filtered / qualified rows in to a dataset table.
> >
> > The problem is this is taking a long time. It's taking 45 secornds just to
> > read about 45k of entries(I get the entrycollection then use a logentry
> > varible to read each one). Are there anyway to improve this?
>



Only administrators can read the security log!

Willy.

.

Relevant Pages

  • Re: Unusual logon / logoff Security event log
    ... I researched the MPS Report but didn't find the Security log. ... Click Services tab and select Hide All Microsoft Services and Disable ... and a logon GUID. ...
    (microsoft.public.windows.server.sbs)
  • Re: Found hackers folder
    ... Both above will tell you who the IP address is registered to and who the ISP ... In the event that the hacker, if it is a hacker, doesn't have a static ... security log. ... Do you have any kind of security ...
    (microsoft.public.win2000.security)
  • Re: Server refreshes its security policy with wrong values
    ... events in the security log for policy change. ... about enabling file access audit for these using the audit feature NTFS ...
    (microsoft.public.windows.server.security)
  • Event Viewer Security log Access denied
    ... computer regarding the Security log in Event Viewer. ... When I click OK there are no events displayed in the security log, ... This occurred even if I logged on with the local administrator account. ...
    (microsoft.public.windowsxp.general)
  • Re: startup/shutdown events not being logged
    ... It sure looks like your Group Policy is good. ... I set my security logs to be at least 10MB. ... what I am getting in the "security" log of one of my XP Pro SP2 computers ... >>First make sure you are looking in the security log for those events ...
    (microsoft.public.windows.server.security)
Loading