I am trying to parse an event log file using
System.Diagnostics.EventLog
, but the way I am parsing the log I need the .evt file to be in the
"C:\Windows\System32\winevt\Logs"
folder however even when I run the program or my IDE in admin mode it can't seem to see the directory or copy anything there.
So my question is how do I either copy the file to that folder?
Or how do I set the program to search a different folder for log files.
public static class EventLogClassContainer
{
public static string EvlLocation { get; set; } = "";
public static string EvlName { get; set; } = "Application";
public static string evlLocationManual = "%Test.evt%";
public static List<EventLogEntry> _LogEntries { get; private set; }
public static void ReadEventLog()
{
EventLog evlLog = new EventLog(EvlName, ".", @"K:\Event Log\Test\Test.evtx");
Parser.FileCopy(EvlName, EvlLocation);
EventLogEntryCollection eventLogEntries = evlLog.Entries;
int eventLogEntryCount = eventLogEntries.Count;
_LogEntries = eventLogEntries.Cast<EventLogEntry>().ToList();
}
public static void SetEvlName(string evlLocation)
{
Parser.FileNameFinder(evlLocation, 3);
}
public static void setLogLocation(string input)
{
EvlLocation = input;
}
}
private void openToolStripMenuItem_Click(object sender, EventArgs e)
{
OpenFile();
}
private void OpenFile()
{
if (openFile.ShowDialog() == DialogResult.OK)
{
ds = new DataSet("EventLog Entries");
ds.Tables.Add("Events");
ds.Tables["Events"].Columns.Add("ComputerName");
ds.Tables["Events"].Columns.Add("EventId");
ds.Tables["Events"].Columns.Add("EventType");
ds.Tables["Events"].Columns.Add("SourceName");
ds.Tables["Events"].Columns.Add("Message");
EventLogClassContainer.EvlLocation = openFile.FileName;
EventLogClassContainer.EvlName = System.IO.Path.GetFileName(openFile.FileName);
worker.RunWorkerAsync(openFile.FileName);
}
}
private void worker_RunWorkerCompleted(object sender, RunWorkerCompletedEventArgs e)
{
EventLogClassContainer.ReadEventLog();
bs = new BindingSource(ds, "Events");
bs.DataSource = EventLogClassContainer._LogEntries;
dataGridView1.DataSource = bs;
this.dataGridView1.DataError += this.DataGridView_DataError;
}
void DataGridView_DataError(object sender, DataGridViewDataErrorEventArgs e)
{
e.ThrowException = false;
}
What I have tried:
I have tried copying the file I need to read to the folder the program is searching through by using this method:
public static void FileCopy(string fileName, string sourcePath)
{
string targetPath = @"C:\Windows\System32\winevt\Logs";
string sourceFile = sourcePath;
string destFile = System.IO.Path.Combine(targetPath, fileName);
if (!System.IO.Directory.Exists(targetPath))
{
System.IO.Directory.CreateDirectory(targetPath);
}
System.IO.File.Copy(sourceFile, destFile, true);
if (System.IO.Directory.Exists(sourcePath))
{
string[] files = System.IO.Directory.GetFiles(sourcePath);
foreach (string s in files)
{
fileName = System.IO.Path.GetFileName(s);
destFile = System.IO.Path.Combine(targetPath, fileName);
System.IO.File.Copy(s, destFile, true);
}
}
else
{
Console.WriteLine("Source path does not exist!");
}
Console.WriteLine("Press any key to exit.");
Console.Read();
}
But even when I do that I receive this exception:
exception of type 'System.InvalidOperationException' occurred in System.dll but was not handled in user code
Additional information: The event log 'Test.evt' on computer '.' does not exist.
Which more or less means FileCopy didn't work or more precisely it couldn't find the folder I was telling it to copy the file into.