Click here to Skip to main content
15,894,955 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I am trying to parse an event log file using System.Diagnostics.EventLog, but the way I am parsing the log I need the .evt file to be in the "C:\Windows\System32\winevt\Logs" folder however even when I run the program or my IDE in admin mode it can't seem to see the directory or copy anything there.

So my question is how do I either copy the file to that folder?
Or how do I set the program to search a different folder for log files.
C#
public static class EventLogClassContainer
    {
        public static string EvlLocation { get; set; } = "";
        public static string EvlName { get; set; } = "Application";
        public static string evlLocationManual = "%Test.evt%";
        public static List<EventLogEntry> _LogEntries { get; private set; }
        public static void ReadEventLog()
        {
            EventLog evlLog = new EventLog(EvlName, ".", @"K:\Event Log\Test\Test.evtx");
            Parser.FileCopy(EvlName, EvlLocation);
            EventLogEntryCollection eventLogEntries = evlLog.Entries;
            int eventLogEntryCount = eventLogEntries.Count;
            _LogEntries = eventLogEntries.Cast<EventLogEntry>().ToList();
        }
        public static void SetEvlName(string evlLocation)
        {
            Parser.FileNameFinder(evlLocation, 3);
        }
        public static void setLogLocation(string input)
        {
            EvlLocation = input;
        }
    }

C#
private void openToolStripMenuItem_Click(object sender, EventArgs e)
        {
            OpenFile();
        }

        // Open the log file
        private void OpenFile()
        {
            // Show file open dialog
            if (openFile.ShowDialog() == DialogResult.OK)
            {
                // Create a dataset for binding the data to the grid.
                ds = new DataSet("EventLog Entries");
                ds.Tables.Add("Events");
                ds.Tables["Events"].Columns.Add("ComputerName");
                ds.Tables["Events"].Columns.Add("EventId");
                ds.Tables["Events"].Columns.Add("EventType");
                ds.Tables["Events"].Columns.Add("SourceName");
                ds.Tables["Events"].Columns.Add("Message");
                // Start the processing as a background process
                EventLogClassContainer.EvlLocation = openFile.FileName;
                EventLogClassContainer.EvlName = System.IO.Path.GetFileName(openFile.FileName);
                
                worker.RunWorkerAsync(openFile.FileName);
            }
        }

C#
private void worker_RunWorkerCompleted(object sender, RunWorkerCompletedEventArgs e)
        {
            EventLogClassContainer.ReadEventLog();
            bs = new BindingSource(ds, "Events");

            bs.DataSource = EventLogClassContainer._LogEntries;
            //Bind fooList to the dataGridView
            dataGridView1.DataSource = bs;

            this.dataGridView1.DataError += this.DataGridView_DataError;
        }
        void DataGridView_DataError(object sender, DataGridViewDataErrorEventArgs e)
        {
            e.ThrowException = false;
        }


What I have tried:

I have tried copying the file I need to read to the folder the program is searching through by using this method:
C#
public static void FileCopy(string fileName, string sourcePath)
        {
            string targetPath = @"C:\Windows\System32\winevt\Logs";

            // Use Path class to manipulate file and directory paths.
            string sourceFile = sourcePath;
            string destFile = System.IO.Path.Combine(targetPath, fileName);

            // To copy a folder's contents to a new location:
            // Create a new target folder, if necessary.
            if (!System.IO.Directory.Exists(targetPath))
            {
                System.IO.Directory.CreateDirectory(targetPath);
            }

            // To copy a file to another location and 
            // overwrite the destination file if it already exists.
            System.IO.File.Copy(sourceFile, destFile, true);

            // To copy all the files in one directory to another directory.
            // Get the files in the source folder. (To recursively iterate through
            // all subfolders under the current directory, see
            // "How to: Iterate Through a Directory Tree.")
            // Note: Check for target path was performed previously
            //       in this code example.
            if (System.IO.Directory.Exists(sourcePath))
            {
                string[] files = System.IO.Directory.GetFiles(sourcePath);

                // Copy the files and overwrite destination files if they already exist.
                foreach (string s in files)
                {
                    // Use static Path methods to extract only the file name from the path.
                    fileName = System.IO.Path.GetFileName(s);
                    destFile = System.IO.Path.Combine(targetPath, fileName);
                    System.IO.File.Copy(s, destFile, true);
                }
            }
            else
            {
                Console.WriteLine("Source path does not exist!");
            }

            // Keep console window open in debug mode.
            Console.WriteLine("Press any key to exit.");
            Console.Read();
        }


But even when I do that I receive this exception:
exception of type 'System.InvalidOperationException' occurred in System.dll but was not handled in user code

Additional information: The event log 'Test.evt' on computer '.' does not exist.
Which more or less means FileCopy didn't work or more precisely it couldn't find the folder I was telling it to copy the file into.
Posted
Comments
Richard MacCutchan 13-Apr-17 4:38am    
The error message is quite clear: your path string does not point to the location where the file is located.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900