NGWS SDK Documentation  

This is preliminary documentation and subject to change.
To comment on this topic, please send us email at ngwssdk@microsoft.com. Thanks!

Event Log References

There are three default event logs on any computer: an application event log, a security event log, and a system event log. In addition to these logs, there may be other default logs that are installed by applications on the server, and custom logs that are created by users. You identify which of these event logs you want to work with. The method of referencing a specific log differs depending on whether you want to read the log's entries or write entries to the log. The following illustration shows the overall process of referencing logs for read or write operations.

Event Log Referencing

Referencing a Log to Read Entries

When you read entries from an event log, you uniquely identify the log you want by machine name and log name. Machine name denotes the Windows 2000 server on which the event log exists, and log name is simply the name of the log. Machine name is optional; if you do not specify a machine, the local computer is assumed.

For example, suppose you have an instance of the EventLog component that you want to use to read entries from a custom log called "OrderEntrySystem, " which is stored on a server named "myserver". You would connect to this log by specifying that:

You can retrieve the machine name of a log by querying the MachineName property. You can retrieve the log name by querying the Log property.

Note When you are referencing a log in an international application, you can query the DisplayName property to retrieve the localized name of the log. You must set the Log property to the non-localized (usually in English) version of the log name.

Referencing a Log to Write Entries

If you are writing entries to an event log, you must specify the Source property. The Source property registers your component with the event log as a valid source of entries. You can specify any string as the value for the Source property; however, it may be helpful to use the name of your project for this value.

Note If the source is already registered with the log, you do not need to set the log name property. You can also not set the machine name; in this case the local machine will be assumed.

For example, suppose you have an instance of the EventLog component that you want to use to write entries to a custom log called "OrderEntrySystem, " which is stored on the local computer. You would connect to this log by specifying that:

Note In this case the period in the machine name indicates the local computer.

A single source can be associated with (and therefore write entries to) only one event log at a time, but a single event log can have many different sources writing to it at once. This means that each instance of the EventLog component can write to only one event log. If you want to write to multiple logs, you must use different instances or change the Source property of an existing instance.

Note   When you are referencing a log in an international application, you can query the DisplayName property to retrieve the localized name of the log. You must set the Log property to the non-localized (usually in English) version of the log name.

See Also

Introduction to the EventLog Component