Click here to Skip to main content
Click here to Skip to main content

A realtime event log monitoring tool

, 27 Aug 2003 CPOL
Rate this:
Please Sign up or sign in to vote.
Demonstrates how to do realtime event log monitoring

Introduction

I'm an instant gratification kind of person. I like to see who and from where my machine is being accessed, as it occurs. This tool allows you to do just that and provides a number of other event log monitoring capabilities.

Background

While testing a piece of software that provides Windows event logging, our QA team questioned if there was a way to monitor events as they are written to the Windows event log, hence the creation of this little utility. The notifications that the tool displays are done so using the most-excellent NotifyIconEx class by Joel Matthias.

Capturing Events

The EventLog class contains an event handler called EntryWritten. This handler expects an argument of type EntryWrittenEventArgs. To capture events as they happen, we simply set the EnableRaisingEvents property to true and declare the method name that will handle the event.

private void StartWatch()
{      
  EventLog myLog = new EventLog(watchLog);
        
  // set event handler
  myLog.EntryWritten += new EntryWrittenEventHandler(OnEntryWritten);
  myLog.EnableRaisingEvents = true;
}

Displaying Events

When events that match the specified criteria occur, a balloon notification is displayed with the details of the last event that was written. (To capture and display Security log events, you must have auditing turned on.)

private void OnEntryWritten(object source, EntryWrittenEventArgs e)
{
  string logName = watchLog;
  GetLogEntryStats(watchLog);
  
  if (logType == eventFilter || eventFilter.Length == 0)
  {
    // show balloon
    NotifyIcon.ShowBalloon("Event Log Monitor",
      "An event was written to the "+logName+" event log."+
      "\nType: "+LogType+
      "\nSource: "+LogSource+
      "\nCategory: "+LogCategory+
      "\nEventID: "+EventID+
      "\nUser: "+User,
      NotifyIconEx.NotifyInfoFlags.Info,
      5000);
        
    LogNotification();
  }
}
    
private void GetLogEntryStats(string logName)
{
  int e = 0;
  
  EventLog log = new EventLog(logName);
  e = log.Entries.Count - 1; // last entry

  logMessage = log.Entries[e].Message;
  logMachine = log.Entries[e].MachineName;
  logSource = log.Entries[e].Source;
  logCategory = log.Entries[e].Category;
  logType = Convert.ToString(log.Entries[e].EntryType);
  eventID = log.Entries[e].EventID.ToString();
  user = log.Entries[e].UserName;
  logTime = log.Entries[e].TimeGenerated.ToShortTimeString();
  log.Close();  // close log
}

The GetEventLogs() method provides an overload for retrieving the logs from a remote machine. It is feasible to assume that event monitoring should work the same on a remote machine as it does on the local computer, given the appropriate permissions. As time permits, I'll be expanding the filtering capabilities of the tool and provide the ability to monitor multiple machines.

Compatibility Issues

The code has only been tested on Windows XP SP1 but should run on Windows 2000. However, while the NotifyIconEx class contains an event handler called BalloonClick, this isn't supported on Windows 2000. Will not work on Win9x or NT4 as they are incapable of displaying balloon notifications.

History

  • Version 1.0 - 08.22.2003

  • License

    This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

    Share

    About the Author

    Marc Merritt
    Architect
    United States United States
    I live in southeastern Pennsylvania, USA with my lovely wife and two beautiful daughters. Life is good. My hobbies are motorcycles, motorcycles, and motorcycles.
     
    I run a riders group called Twisties Motorcycle Club. If you're are a rider in the tri-state area, look us up! http://twistiesmc.com/
    Follow on   Twitter

    Comments and Discussions

     
    QuestionUnable to load the demo project provided in Visual studio 2010 on Win7 PinmemberMember 967436313-Dec-12 18:08 
    QuestionHow to monitor Application and Services Logs/Microsoft/Windows/Diagnosis-PLA PinmemberMember 424543724-May-12 0:05 
    GeneralMy vote of 1 Pinmembermmmgedadads26-Feb-11 23:09 
    GeneralMy vote of 1 Pinmemberblizznet20-Dec-10 4:54 
    GeneralCross-Thread Operation Pinmemberkjward15-Apr-10 7:18 
    GeneralEvent Log Watcher Pinmembertuxplorer14-Feb-10 23:11 
    GeneralEvent log monitoring is not supported for remote machines PinmemberBruce Ritter29-Aug-08 7:53 
    GeneralCross-thread operation not valid: PinmemberWill Saunders30-Jul-08 4:05 
    GeneralRe: Cross-thread operation not valid: Pinmembereyal.flato8-Dec-08 23:54 
    QuestionDoesn't work for me Pinmemberbitstream0323-Aug-07 23:49 
    AnswerRe: Doesn't work for me PinmemberMarc Merritt24-Aug-07 6:39 
    QuestionVista Pinmemberchemelli6-Jul-07 21:20 
    AnswerRe: Vista PinmemberMarc Merritt8-Jul-07 4:05 
    GeneralException trying to recompile and run the event log monitoring source code using Visual Studio 5 PinmemberNtanga27-Jun-07 2:42 
    GeneralRe: Exception trying to recompile and run the event log monitoring source code using Visual Studio 5 PinmemberMarc Merritt28-Jun-07 16:19 
    QuestionHow to read event full description from remote machine ? Pinmemberremotehuang19-Jun-07 4:49 
    AnswerRe: How to read event full description from remote machine ? PinmemberMarc Merritt28-Jun-07 16:12 
    AnswerRe: How to read event full description from remote machine ? PinmemberCool Cassis6-Jul-07 12:16 
    Questioncontact Marc PinmemberChris Blue29-Mar-07 19:32 
    AnswerRe: contact Marc Pinmemberjbono00711-May-07 12:51 
    AnswerRe: contact Marc PinmemberMarc Merritt28-Jun-07 16:21 
    Questionwatch all 3 logs + display full log entry PinmemberChris Blue10-Aug-07 10:24 
    General=== pleeeeease === PinmemberChris Blue29-Mar-07 19:09 
    QuestionHow to display the EVENT LOG MESSAGE TEXT? 1000 thanks for helping !!! PinmemberChris Blue2-Mar-07 19:36 
    AnswerRe: How to display the EVENT LOG MESSAGE TEXT? 1000 thanks for helping !!! PinmemberChris Blue2-Mar-07 19:40 
    GeneralThanks for the most excellent code! PinmemberWilliam E. Thompson14-Feb-07 5:18 
    GeneralRe: Thanks for the most excellent code! PinmemberMarc Merritt14-Feb-07 5:32 
    GeneralUpdate to the code posted above. PinmemberWilliam E. Thompson14-Feb-07 7:44 
    GeneralCOOL!!! PinmemberNicola Costantini29-Sep-06 0:34 
    GeneralRe: COOL!!! PinmemberMarc Merritt28-Jun-07 16:21 
    GeneralA little help with a modification I made to your app.. Pinmembergonepostal55528-Jun-06 6:31 
    GeneralRe: A little help with a modification I made to your app.. PinmemberJim Weiler7-Sep-07 17:18 
    Generalnotification on error event only Pinmemberc-a-b-9-Mar-06 2:09 
    GeneralRe: notification on error event only PinmemberJonnystar21-Mar-06 10:57 
    QuestionMultiple logs? Pinmemberceltboy30-Oct-05 15:49 
    AnswerRe: Multiple logs? PinmemberJonnystar21-Mar-06 11:01 
    QuestionAppropriate Permissions? PinmemberJVMFX20-Oct-05 3:12 
    AnswerRe: Appropriate Permissions? PinmemberMarc Merritt20-Oct-05 3:37 
    GeneralLimitations PinmemberGreg Ennis22-Dec-04 3:30 
    GeneralRe: Limitations Pinsussdm218-Apr-05 8:27 
    GeneralRe: Limitations PinmemberJonnystar21-Mar-06 11:05 
    GeneralProblem with the monitoring tool Pinmemberpat27088128-Jul-04 6:38 
    GeneralRe: Problem with the monitoring tool PinmemberMarc Merritt28-Jul-04 8:00 
    GeneralRe: Problem with the monitoring tool Pinmemberpat27088128-Jul-04 8:13 
    GeneralRe: Problem with the monitoring tool PinmemberMarc Merritt28-Jul-04 10:06 
    GeneralRe: Problem with the monitoring tool Pinmemberpat27088128-Jul-04 10:09 
    GeneralRe: Problem with the monitoring tool Pinmemberpat27088128-Jul-04 22:19 
    GeneralRe: Problem with the monitoring tool Pinmemberpat27088128-Jul-04 22:59 
    GeneralRe: Problem with the monitoring tool Pinmemberpat27088130-Jul-04 22:12 
    GeneralRe: Problem with the monitoring tool PinmemberMarc Merritt1-Aug-04 6:13 

    General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

    Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

    | Advertise | Privacy | Mobile
    Web04 | 2.8.141022.2 | Last Updated 28 Aug 2003
    Article Copyright 2003 by Marc Merritt
    Everything else Copyright © CodeProject, 1999-2014
    Terms of Service
    Layout: fixed | fluid