C# - Read Nested Event Log From Custom Application

Question

I am using sysmon to capture a bunch of event information (network connections, DLL loads, etc). I want to pull that information and use it for various purposes, but it doesn't seem like there is any way to retrieve the nested logs. They reside at

Event Viewer/Applications and Services/Microsoft/Windows/Sysmon/Operational

All of the code I've tried only pulls the "standard" Event Logs. For example:

EventLog[] eventLogs = EventLog.GetEventLogs();

has "Application", "Hardware Events", "Internet Explorer", etc.

I know how to create and retrieve custom event logs, but that doesn't seem to apply here, as these logs are not in the standard locations. Any help you can provide would be very much appreciated!

I would try looking at the System.Diagnostics.Eventing.Reader namespace. It has a much richer API for getting event logs. EventLogSession.GetLogNames returns much larger list than EventLog.GetEventLogs. — Mike Zboray
– Mike Zboray, Commented Apr 19, 2015 at 2:53
^^ This is EXACTLY what I was looking for. Thank you so much :) If you answer I'll mark it. — adamdabb
– adamdabb, Commented Apr 19, 2015 at 14:48

Mike Zboray · Accepted Answer · 2015-04-19 15:48:01Z

6

Take a look at the System.Diagnostics.Eventing.Reader namespace. In particular, you can get a complete list of log names from:

EventLogSession.GlobalSession.GetLogNames()

This has a much more complete list than EventLog.GetEventLogs(). Other useful classes in this namespace are EventLogReader and EventLogWatcher.

answered Apr 19, 2015 at 15:48

Mike Zboray

41.1k3 gold badges102 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

C# - Read Nested Event Log From Custom Application

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related