EventLogQuery time format expected?

Question

I\'m trying to use the EventLogQuery class to query the eventlog. I followed the example shown on http://msdn.microsoft.com/en-us/library/bb671200%28v=vs.90%29.aspx#Y0.

Answer 1

Failed Login IP List in Last 2 Hour. EventID=4625 AND CreatedDate >= Last 2 Hour

var AfterTime = DateTime.Now.AddMinutes(-120);

string queryString =
                    "" +
                    "  " +
                    $"    *[System[(EventID=4625) and TimeCreated[@SystemTime>='{AfterTime.ToString("o")}']]]" +
                    "  " +
                    "";  

var reader = new EventLogReader(new EventLogQuery("Security", PathType.LogName, queryString));

for (EventRecord eventDetail = reader.ReadEvent(); eventDetail != null; eventDetail = reader.ReadEvent())
{
    if (eventDetail.Id == 4625 && eventDetail.TimeCreated >= AfterTime)// Extra security, check again
    {
                    IPlist.Add(eventDetail.Properties[eventDetail.Properties.Count - 2].Value.ToString()); // Get IP Adress, Last Second Element Has IP Adress
    }

}

var AttackerIP = IPlist.GroupBy(x => x).Select(x => x.Key).ToList();