Click here to Skip to main content
14,210,491 members
Click here to Skip to main content
Posted 27 Aug 2003


107 bookmarked

A realtime event log monitoring tool

Rate this:
4.59 (30 votes)
Please Sign up or sign in to vote.
4.59 (30 votes)
27 Aug 2003     CPOL    
Demonstrates how to do realtime event log monitoring


I'm an instant gratification kind of person. I like to see who and from where my machine is being accessed, as it occurs. This tool allows you to do just that and provides a number of other event log monitoring capabilities.


While testing a piece of software that provides Windows event logging, our QA team questioned if there was a way to monitor events as they are written to the Windows event log, hence the creation of this little utility. The notifications that the tool displays are done so using the most-excellent NotifyIconEx class by Joel Matthias.

Capturing Events

The EventLog class contains an event handler called EntryWritten. This handler expects an argument of type EntryWrittenEventArgs. To capture events as they happen, we simply set the EnableRaisingEvents property to true and declare the method name that will handle the event.

private void StartWatch()
  EventLog myLog = new EventLog(watchLog);
  // set event handler
  myLog.EntryWritten += new EntryWrittenEventHandler(OnEntryWritten);
  myLog.EnableRaisingEvents = true;

Displaying Events

When events that match the specified criteria occur, a balloon notification is displayed with the details of the last event that was written. (To capture and display Security log events, you must have auditing turned on.)

private void OnEntryWritten(object source, EntryWrittenEventArgs e)
  string logName = watchLog;
  if (logType == eventFilter || eventFilter.Length == 0)
    // show balloon
    NotifyIcon.ShowBalloon("Event Log Monitor",
      "An event was written to the "+logName+" event log."+
      "\nType: "+LogType+
      "\nSource: "+LogSource+
      "\nCategory: "+LogCategory+
      "\nEventID: "+EventID+
      "\nUser: "+User,
private void GetLogEntryStats(string logName)
  int e = 0;
  EventLog log = new EventLog(logName);
  e = log.Entries.Count - 1; // last entry

  logMessage = log.Entries[e].Message;
  logMachine = log.Entries[e].MachineName;
  logSource = log.Entries[e].Source;
  logCategory = log.Entries[e].Category;
  logType = Convert.ToString(log.Entries[e].EntryType);
  eventID = log.Entries[e].EventID.ToString();
  user = log.Entries[e].UserName;
  logTime = log.Entries[e].TimeGenerated.ToShortTimeString();
  log.Close();  // close log

The GetEventLogs() method provides an overload for retrieving the logs from a remote machine. It is feasible to assume that event monitoring should work the same on a remote machine as it does on the local computer, given the appropriate permissions. As time permits, I'll be expanding the filtering capabilities of the tool and provide the ability to monitor multiple machines.

Compatibility Issues

The code has only been tested on Windows XP SP1 but should run on Windows 2000. However, while the NotifyIconEx class contains an event handler called BalloonClick, this isn't supported on Windows 2000. Will not work on Win9x or NT4 as they are incapable of displaying balloon notifications.


  • Version 1.0 - 08.22.2003

  • License

    This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


    About the Author

    Marc Merritt
    Product Manager
    United States United States
    I work for one of the world's best companies as a technical architecture delivery manager.

    Comments and Discussions

    AnswerRe: How to read event full description from remote machine ? Pin
    Marc Merritt28-Jun-07 16:12
    memberMarc Merritt28-Jun-07 16:12 
    AnswerRe: How to read event full description from remote machine ? Pin
    Cool Cassis6-Jul-07 12:16
    memberCool Cassis6-Jul-07 12:16 
    Questioncontact Marc Pin
    Chris Blue29-Mar-07 19:32
    memberChris Blue29-Mar-07 19:32 
    AnswerRe: contact Marc Pin
    jbono00711-May-07 12:51
    memberjbono00711-May-07 12:51 
    AnswerRe: contact Marc Pin
    Marc Merritt28-Jun-07 16:21
    memberMarc Merritt28-Jun-07 16:21 
    Questionwatch all 3 logs + display full log entry Pin
    Chris Blue10-Aug-07 10:24
    memberChris Blue10-Aug-07 10:24 
    General=== pleeeeease === Pin
    Chris Blue29-Mar-07 19:09
    memberChris Blue29-Mar-07 19:09 
    QuestionHow to display the EVENT LOG MESSAGE TEXT? 1000 thanks for helping !!! Pin
    Chris Blue2-Mar-07 19:36
    memberChris Blue2-Mar-07 19:36 
    Hi, great stuff! Thanks for sharing!

    Would be wicked if the balloon tip would also include the actual EVENT LOG MESSAGE TEXT. Then you wouldn't have to check in the event viewer every time.

    I guess that would be real easy to code ... by adding a line somewhere here, no ?

    NotifyIcon.ShowBalloon("Event Log Monitor",
    "An event was written to the "+logName+" event log."+
    "\nType: "+LogType+
    "\nSource: "+LogSource+
    "\nCategory: "+LogCategory+
    "\nEventID: "+EventID+
    "\nUser: "+User,

    Unfortunately, I'm no coder, I don't even know which language that is ;(
    And I don't know neither how to make a running .exe out of these lines :p

    Is there a good soul around who would add that line and send me a modified .exe ? I give you my mail:

    100000 thanks!!

    I would be REALLY REALLY thankful!!! Thanks in advance to anybody who can help.

    Kind regards,

    AnswerRe: How to display the EVENT LOG MESSAGE TEXT? 1000 thanks for helping !!! Pin
    Chris Blue2-Mar-07 19:40
    memberChris Blue2-Mar-07 19:40 
    GeneralThanks for the most excellent code! Pin
    William E. Thompson14-Feb-07 5:18
    memberWilliam E. Thompson14-Feb-07 5:18 
    GeneralRe: Thanks for the most excellent code! Pin
    Marc Merritt14-Feb-07 5:32
    memberMarc Merritt14-Feb-07 5:32 
    GeneralUpdate to the code posted above. Pin
    William E. Thompson14-Feb-07 7:44
    memberWilliam E. Thompson14-Feb-07 7:44 
    GeneralCOOL!!! Pin
    Nicola Costantini29-Sep-06 0:34
    memberNicola Costantini29-Sep-06 0:34 
    GeneralRe: COOL!!! Pin
    Marc Merritt28-Jun-07 16:21
    memberMarc Merritt28-Jun-07 16:21 
    GeneralA little help with a modification I made to your app.. Pin
    gonepostal55528-Jun-06 6:31
    membergonepostal55528-Jun-06 6:31 
    GeneralRe: A little help with a modification I made to your app.. Pin
    Jim Weiler7-Sep-07 17:18
    memberJim Weiler7-Sep-07 17:18 
    Generalnotification on error event only Pin
    c-a-b-9-Mar-06 2:09
    memberc-a-b-9-Mar-06 2:09 
    GeneralRe: notification on error event only Pin
    Jonnystar21-Mar-06 10:57
    memberJonnystar21-Mar-06 10:57 
    QuestionMultiple logs? Pin
    celtboy30-Oct-05 15:49
    memberceltboy30-Oct-05 15:49 
    AnswerRe: Multiple logs? Pin
    Jonnystar21-Mar-06 11:01
    memberJonnystar21-Mar-06 11:01 
    QuestionAppropriate Permissions? Pin
    JVMFX20-Oct-05 3:12
    memberJVMFX20-Oct-05 3:12 
    AnswerRe: Appropriate Permissions? Pin
    Marc Merritt20-Oct-05 3:37
    memberMarc Merritt20-Oct-05 3:37 
    GeneralLimitations Pin
    Los Guapos22-Dec-04 3:30
    memberLos Guapos22-Dec-04 3:30 
    GeneralRe: Limitations Pin
    dm218-Apr-05 8:27
    memberdm218-Apr-05 8:27 
    GeneralRe: Limitations Pin
    Jonnystar21-Mar-06 11:05
    memberJonnystar21-Mar-06 11:05 

    General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

    Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

    Permalink | Advertise | Privacy | Cookies | Terms of Use | Mobile
    Web05 | 2.8.190618.1 | Last Updated 28 Aug 2003
    Article Copyright 2003 by Marc Merritt
    Everything else Copyright © CodeProject, 1999-2019
    Layout: fixed | fluid