Programmatically create a custom Eventlog view

问题

I want to programmatically create a custom Eventlog view in a C# application.

This is how to create a custom Eventlog view with the help of the Eventlog application from Microsoft Windows:

I searched the class System.Diagnostics.EventLog for a method that does the same as the button found in the Eventlog Application from Microsoft. Sadly, i couldn't find any functionality that covers my needs.

Has anyone ever programmatically created a custom Eventlog view in C# or knows a way that works?

回答1:

If just tested the approach found here:

try
{
    XmlTextWriter view = new XmlTextWriter("C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\View_1.xml", Encoding.Unicode);
    // Root.
    view.WriteStartDocument();
    view.WriteStartElement("ViewerConfig");
    //Create Node for queryConfig
    view.WriteStartElement("QueryConfig");
    view.WriteStartElement("QueryParams");
    view.WriteStartElement("UserQuery");
    view.WriteEndElement();
    view.WriteEndElement();
    //QueryNode
    view.WriteStartElement("QueryNode");
    //....

    view.Close();
}
catch (XmlException ex)
{
    Console.WriteLine(ex.StackTrace);
}

This created a custom view for me.

Basically, custom views are xml files stored under C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ and you can just roll you own, by creating an xml document.

If you want to know how to format such an xml document, you can always fall back to the already pre defined querys in the Server Roles folder under C:\ProgramData\Microsoft\Event Viewer\Views\ServerRoles

回答2:

Possible solution is:

Create a desired custom view using eventvwr.msc interface (shown on image provided by you).
Export it to a .xml file and study/make little research about it's structure
Write a code to generate such .xml file based on your needs or use already crafted and exported only replacing appropriate "placeholders" (event codes, event sources, etc.)
Run eventvwr.exe with /v option like eventvwr.exe /v:MyView.xml (more options using eventvwr.exe /?)

来源：https://stackoverflow.com/questions/29695358/programmatically-create-a-custom-eventlog-view

标签

event-log