System.Diagnostics.EventLog

Provides data for the event.

Initializes a new instance of the class.

Initializes a new instance of the class with the specified event log entry.

An that represents the entry that was written.

Gets the event log entry that was written to the log.

An that represents the entry that was written to the event log.

Represents the method that will handle the event of an .

The source of the event. An that contains the event data.

Represents a placeholder (bookmark) within an event stream. You can use the placeholder to mark a position and return to this position in a stream of events. An instance of this object can be obtained from an object, in which case it corresponds to the position of that event record.

Creates a bookmark that identifies an event in a channel.

An XML string that represents the bookmark.

Gets the XML string that represents the bookmark.

Represents a keyword for an event. Keywords are defined in an event provider and are used to group the event with other similar events (based on the usage of the events).

Gets the localized name of the keyword.

A string that contains a localized name for this keyword.

Gets the non-localized name of the keyword.

A string that contains the non-localized name of this keyword.

Gets the numeric value associated with the keyword.

The numeric value associated with the keyword.

Contains an event level that is defined in an event provider. The level signifies the severity of the event.

Gets the localized name for the event level. The name describes what severity level of events this level is used for.

A string that contains the localized name for the event level.

Gets the non-localized name of the event level.

A string that contains the non-localized name of the event level.

Gets the numeric value of the event level.

The numeric value of the event level.

Contains static information and configuration settings for an event log. Many of the configurations settings were defined by the event provider that created the log.

Initializes a new object by specifying the name of the log for which to get information and configuration settings. The log can be on the local computer or a remote computer, based on the event log session specified.

The name of the event log for which to get information and configuration settings. The event log session used to determine the event log service that the specified log belongs to. The session is either connected to the event log service on the local computer or a remote computer.

Initializes a new object by specifying the local event log for which to get information and configuration settings.

The name of the local event log for which to get information and configuration settings.

Releases all the resources used by this object.

Releases the unmanaged resources used by this object, and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Saves the configuration settings that.

Gets a value that indicates whether the event log is a classic event log. A classic event log is one that has its events defined in an .mc file instead of a manifest (.xml file) used by the event provider.

if the event log is a classic log; otherwise, .

Gets or sets a value that indicates whether the event log is enabled or disabled. An enabled log is one in which events can be logged, and a disabled log is one in which events cannot be logged.

if the log is enabled; otherwise, .

Gets or sets the file directory path to the location of the file where the events are stored for the log.

A string that contains the path to the event log file.

Gets an value that specifies whether the event log is an application, system, or custom event log.

One of the enumeration values.

Gets or sets an value that determines how events are handled when the event log becomes full.

One of the enumeration values.

Gets the name of the event log.

The name of the event log.

Gets an value that determines the type of the event log.

One of the enumeration values.

Gets or sets the maximum size, in bytes, that the event log file is allowed to be. When the file reaches this maximum size, it is considered full.

The maximum size, in bytes, that the event log file is allowed to be.

Gets the name of the event provider that created this event log.

The name of the event provider that created this event log.

Gets the size of the buffer that the event provider uses for publishing events to the log.

The size of the buffer that the event provider uses for publishing events to the log. It can be .

Gets the control globally unique identifier (GUID) for the event log if the log is a debug log. If this log is not a debug log, this value is .

A GUID value, or if the log is not a debug log.

Gets or sets the keyword mask used by the event provider.

The keyword mask used by the event provider, or if the event provider did not define any keywords.

Gets the maximum latency time used by the event provider when publishing events to the log.

The maximum latency time used by the event provider when publishing events to the log, or if no latency time was specified by the event provider.

Gets or sets the maximum event level (which defines the severity of the event) that is allowed to be logged in the event log. This value is defined by the event provider.

The maximum event level that is allowed to be logged in the event log, or if the maximum event level was not defined in the event provider.

Gets the maximum number of buffers used by the event provider to publish events to the event log.

The maximum number of buffers used by the event provider to publish events to the event log. This value can be .

Gets the minimum number of buffers used by the event provider to publish events to the event log.

The minimum number of buffers used by the event provider to publish events to the event log. This value can be .

Gets an enumerable collection of the names of all the event providers that can publish events to this event log.

An enumerable collection of strings that contain the event provider names.

Gets or sets the security descriptor of the event log. The security descriptor defines the users and groups of users that can read and write to the event log.

A string that contains the security descriptor for the event log.

Represents the base class for all the exceptions that are thrown when an error occurs while reading event log related information.

Initializes a new instance of the class.

Initializes a new instance of the class with the error code for the exception.

The error code for the error that occurred while reading or configuring event log related information.

Initializes a new instance of the class with serialized data.

The object that holds the serialized object data about the exception being thrown. The object that contains contextual information about the source or destination.

Initializes a new instance of the class with an error message and inner exception.

The error message that describes the current exception. The Exception instance that caused the current exception.

Initializes a new instance of the class by specifying the error message that describes the current exception.

The error message that describes the current exception.

Sets the SerializationInfo object with information about the exception.

The object that holds the serialized object data about the exception thrown. The object that contains contextual information about the source or destination.

Gets the error message that describes the current exception.

Returns a string that contains the error message that describes the current exception.

Allows you to access the run-time properties of active event logs and event log files. These properties include the number of events in the log, the size of the log, a value that determines whether the log is full, and the last time the log was written to or accessed.

Gets the file attributes of the log file associated with the log.

Returns an integer value. This value can be null.

Gets the time that the log file associated with the event log was created.

Returns a object. This value can be null.

Gets the size of the file, in bytes, associated with the event log.

Returns a long value.

Gets a Boolean value that determines whether the log file has reached its maximum size (the log is full).

Returns if the log is full, and returns if the log is not full.

Gets the last time the log file associated with the event log was accessed.

Returns a object. This value can be null.

Gets the last time data was written to the log file associated with the event log.

Returns a object. This value can be null.

Gets the number of the oldest event record in the event log.

Returns a long value that represents the number of the oldest event record in the event log. This value can be null.

Gets the number of event records in the event log.

Returns a long value that represents the number of event records in the event log. This value can be null.

Represents the exception thrown when an event provider publishes invalid data in an event.

Initializes a new instance of the class.

Initializes a new instance of the class with serialized data.

The object that holds the serialized object data about the exception thrown. The object that contains contextual information about the source or destination.

Initializes a new instance of the class with an error message and inner exception.

The error message that describes the current exception. The Exception instance that caused the current exception.

Initializes a new instance of the class by specifying the error message that describes the current exception.

The error message that describes the current exception.

Defines the default access permissions for the event log. The Application and System values indicate that the log shares the access control list (ACL) with the appropriate Windows log (the Application or System event logs) and share the Event Tracing for Windows (ETW) session with other logs of the same isolation. All channels with Custom isolation use a private ETW session.

The log shares the access control list with the Application event log and shares the ETW session with other logs that have Application isolation.

The event log is a custom event log that uses its own private ETW session.

The log shares the access control list with the System event log and shares the ETW session with other logs that have System isolation.

Represents a link between an event provider and an event log that the provider publishes events into. This object cannot be instantiated.

Gets the localized name of the event log.

Returns a string that contains the localized name of the event log.

Gets a Boolean value that determines whether the event log is imported, rather than defined in the event provider. An imported event log is defined in a different provider.

Returns if the event log is imported by the event provider, and returns if the event log is not imported by the event provider.

Gets the non-localized name of the event log associated with this object.

Returns a string that contains the non-localized name of the event log associated with this object.

Determines the behavior for the event log service handles an event log when the log reaches its maximum allowed size (when the event log is full).

Archive the log when full, do not overwrite events. The log is automatically archived when necessary. No events are overwritten.

New events continue to be stored when the log file is full. Each new incoming event replaces the oldest event in the log.

Do not overwrite events. Clear the log manually rather than automatically.

Represents the exception that is thrown when a requested event log (usually specified by the name of the event log or the path to the event log file) does not exist.

Initializes a new instance of the class.

Initializes a new instance of the class with serialized data.

The object that holds the serialized object data about the exception thrown. The object that contains contextual information about the source or destination.

Initializes a new instance of the class with an error message and inner exception.

The error message that describes the current exception. The Exception instance that caused the current exception.

Initializes a new instance of the class by specifying the error message that describes the current exception.

The error message that describes the current exception.

Contains an array of strings that represent XPath queries for elements in the XML representation of an event, which is based on the Event Schema. The queries in this object are used to extract values from the event.

Initializes a new class instance.

XPath queries used to extract values from the XML representation of the event.

Releases all the resources used by this object.

Releases the unmanaged resources used by this object, and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Represents the exception that is thrown when a specified event provider name references a disabled event provider. A disabled event provider cannot publish events.

Initializes a new instance of the class.

Initializes a new instance of the class with serialized data.

The object that holds the serialized object data about the exception thrown. The object that contains contextual information about the source or destination.

Initializes a new instance of the class with an error message and inner exception.

The error message that describes the current exception. The Exception instance that caused the current exception.

Initializes a new instance of the class by specifying the error message that describes the current exception.

The error message that describes the current exception.

Represents a query for events in an event log and the settings that define how the query is executed and on what computer the query is executed on.

Initializes a new instance of the class by specifying the target of the query and the event query. The target can be an active event log or a log file.

The name of the event log to query, or the path to the event log file to query. Specifies whether the string used in the path parameter specifies the name of an event log, or the path to an event log file. The event query used to retrieve events that match the query conditions.

Initializes a new instance of the class by specifying the target of the query. The target can be an active event log or a log file.

Gets or sets the Boolean value that determines whether to read events from the newest event in an event log to the oldest event in the log.

Returns if events are read from the newest event in the log to the oldest event, and returns if events are read from the oldest event in the log to the newest event.

Gets or sets the session that access the Event Log service on the local computer or a remote computer. This object can be set to access a remote event log by creating a object or an object with this object.

Returns an object.

Gets or sets a Boolean value that determines whether this query will continue to retrieve events when the query has an error.

indicates that the query will continue to retrieve events even if the query fails for some logs, and indicates that this query will not continue to retrieve events when the query fails.

Enables you to read events from an event log based on an event query. The events that are read by this object are returned as objects.

Initializes a new instance of the class by specifying an event query and a bookmark that is used as starting position for the query.

The event query used to retrieve events. The bookmark (placeholder) used as a starting position in the event log or stream of events. Only events logged after the bookmark event will be returned by the query.

Initializes a new instance of the class by specifying an event query.

The event query used to retrieve events.

Initializes a new instance of the class by specifying the name of an event log to retrieve events from or the path to a log file to retrieve events from.

The name of the event log to retrieve events from, or the path to the event log file to retrieve events from. Specifies whether the string used in the path parameter specifies the name of an event log, or the path to an event log file.

Initializes a new instance of the class by specifying an active event log to retrieve events from.

The name of the event log to retrieve events from.

Cancels the current query operation.

Releases all the resources used by this object.

Releases the unmanaged resources used by this object, and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Reads the next event that is returned from the event query in this object.

Returns an object.

Reads the next event that is returned from the event query in this object.

The maximum time to allow the read operation to run before canceling the operation. Returns an object.

Changes the position in the event stream where the next event that is read will come from by specifying a bookmark event and an offset number of events from the bookmark. No events logged before the bookmark plus the offset will be retrieved.

The bookmark (placeholder) used as a starting position in the event log or stream of events. Only events that have been logged after the bookmark event will be returned by the query. The offset number of events to change the position of the bookmark.

Changes the position in the event stream where the next event that is read will come from by specifying a bookmark event. No events logged before the bookmark event will be retrieved.

The bookmark (placeholder) used as a starting position in the event log or stream of events. Only events that have been logged after the bookmark event will be returned by the query.

Changes the position in the event stream where the next event that is read will come from by specifying a starting position and an offset from the starting position. No events logged before the starting position plus the offset will be retrieved.

A value from the enumeration defines where in the stream of events to start querying for events. The offset number of events to add to the origin.

Gets or sets the number of events retrieved from the stream of events on every read operation.

Returns an integer value.

Gets the status of each event log or log file associated with the event query in this object.

Returns a list of objects that each contain status information about an event log associated with the event query in this object.

Represents an exception that is thrown when an error occurred while reading, querying, or subscribing to the events in an event log.

Initializes a new instance of the class.

Initializes a new instance of the class with serialized data.

The object that holds the serialized object data about the exception thrown. The object that contains contextual information about the source or destination.

Initializes a new instance of the class with an error message and inner exception.

The error message that describes the current exception. The Exception instance that caused the current exception.

Initializes a new instance of the class by specifying the error message that describes the current exception.

The error message that describes the current exception.

Contains the properties of an event instance for an event that is received from an object. The event properties provide information about the event such as the name of the computer where the event was logged and the time that the event was created.

Releases the unmanaged resources used by this object, and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Gets the event message in the current locale.

Returns a string that contains the event message in the current locale.

Gets the event message, replacing variables in the message with the specified values.

The values used to replace variables in the event message. Variables are represented by %n, where n is a number. Returns a string that contains the event message in the current locale.

Gets the enumeration of the values of the user-supplied event properties, or the results of XPath-based data if the event has XML representation.

Selects the property values to return. Returns a list of objects.

Gets the XML representation of the event. All of the event properties are represented in the event's XML. The XML conforms to the event schema.

Returns a string that contains the XML representation of the event.

Gets the globally unique identifier (GUID) for the activity in process for which the event is involved. This allows consumers to group related activities.

Returns a GUID value.

Gets a placeholder (bookmark) that corresponds to this event. This can be used as a placeholder in a stream of events.

Returns a object.

Gets the name of the event log or the event log file in which the event is stored.

Returns a string that contains the name of the event log or the event log file in which the event is stored.

Gets the identifier for this event. All events with this identifier value represent the same type of event.

Returns an integer value. This value can be null.

Gets the keyword mask of the event. Get the value of the property to get the name of the keywords used in this mask.

Returns a long value. This value can be null.

Gets the display names of the keywords used in the keyword mask for this event.

Returns an enumerable collection of strings that contain the display names of the keywords used in the keyword mask for this event.

Gets the level of the event. The level signifies the severity of the event. For the name of the level, get the value of the property.

Returns a byte value. This value can be null.

Gets the display name of the level for this event.

Returns a string that contains the display name of the level for this event.

Gets the name of the event log where this event is logged.

Returns a string that contains a name of the event log that contains this event.

Gets the name of the computer on which this event was logged.

Returns a string that contains the name of the computer on which this event was logged.

Gets a list of query identifiers that this event matches. This event matches a query if the query would return this event.

Returns an enumerable collection of integer values.

Gets the opcode of the event. The opcode defines a numeric value that identifies the activity or a point within an activity that the application was performing when it raised the event. For the name of the opcode, get the value of the property.

Returns a short value. This value can be null.

Gets the display name of the opcode for this event.

Returns a string that contains the display name of the opcode for this event.

Gets the process identifier for the event provider that logged this event.

Returns an integer value. This value can be null.

Gets the user-supplied properties of the event.

Returns a list of objects.

Gets the globally unique identifier (GUID) of the event provider that published this event.

Returns a GUID value. This value can be null.

Gets the name of the event provider that published this event.

Returns a string that contains the name of the event provider that published this event.

Gets qualifier numbers that are used for event identification.

Returns an integer value. This value can be null.

Gets the event record identifier of the event in the log.

Returns a long value. This value can be null.

Gets a globally unique identifier (GUID) for a related activity in a process for which an event is involved.

Returns a GUID value. This value can be null.

Gets a task identifier for a portion of an application or a component that publishes an event. A task is a 16-bit value with 16 top values reserved. This type allows any value between 0x0000 and 0xffef to be used. For the name of the task, get the value of the property.

Returns an integer value. This value can be null.

Gets the display name of the task for the event.

Returns a string that contains the display name of the task for the event.

Gets the thread identifier for the thread that the event provider is running in.

Returns an integer value. This value can be null.

Gets the time, in format, that the event was created.

Returns a value. The value can be null.

Gets the security descriptor of the user whose context is used to publish the event.

Returns a value.

Gets the version number for the event.

Returns a byte value. This value can be null.

Used to access the Event Log service on the local computer or a remote computer so you can manage and gather information about the event logs and event providers on the computer.

Initializes a new object, establishes a connection with the local Event Log service.

Initializes a new object, and establishes a connection with the Event Log service on the specified computer. The specified credentials (user name and password) are used for the credentials to access the remote computer.

The name of the computer on which to connect to the Event Log service. The domain of the specified user. The user name used to connect to the remote computer. The password used to connect to the remote computer. The type of connection to use for the connection to the remote computer.

Initializes a new object, and establishes a connection with the Event Log service on the specified computer. The credentials (user name and password) of the user who calls the method is used for the credentials to access the remote computer.

The name of the computer on which to connect to the Event Log service.

Cancels any operations (such as reading an event log or subscribing to an event log) that are currently active for the Event Log service that this session object is connected to.

Clears events from the specified event log, and saves the cleared events to the specified file.

The name of the event log to clear all the events from. The path to the file in which the cleared events will be saved. The file should end in .evtx.

Clears events from the specified event log.

The name of the event log to clear all the events from.

Releases all the resources used by this object.

Releases the unmanaged resources used by this object, and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Exports events into an external log file. A flag can be set to indicate that the method will continue exporting events even if the specified query fails for some logs. The events are stored without the event messages.

The name of the event log to export events from, or the path to the event log file to export events from. Specifies whether the string used in the path parameter specifies the name of an event log, or the path to an event log file. The query used to select the events to export. Only the events returned from the query will be exported. The path to the log file (ends in .evtx) in which the exported events will be stored after this method is executed. indicates that the method will continue exporting events even if the specified query fails for some logs, and indicates that this method will not continue to export events when the specified query fails.

Exports events into an external log file. The events are stored without the event messages.

Exports events and their messages into an external log file. A flag can be set to indicate that the method will continue exporting events even if the specified query fails for some logs. The event messages are exported in the specified language.

Exports events and their messages into an external log file.

Gets an object that contains runtime information for the specified event log.

The name of the event log to get information about, or the path to the event log file to get information about. Specifies whether the string used in the path parameter specifies the name of an event log, or the path to an event log file. An object that contains information about the specified log.

Gets an enumerable collection of all the event log names that are registered with the Event Log service.

An enumerable collection of strings that contain the event log names.

Gets an enumerable collection of all the event provider names that are registered with the Event Log service. An event provider is an application that publishes events to an event log.

An enumerable collection of strings that contain the event provider names.

Gets a static predefined session object that is connected to the Event Log service on the local computer.

A predefined session object that is connected to the Event Log service on the local computer.

Contains the status code or error code for a specific event log. This status can be used to determine if the event log is available for an operation.

Gets the name of the event log for which the status code is obtained.

The name of the event log for which the status code is obtained.

Gets the status code or error code for the event log. This status or error is the result of a read or subscription operation on the event log.

The status code or error code for the event log.

Defines the type of events that are logged in an event log. Each log can only contain one type of event.

These events are primarily for end users, administrators, and support. The events that are found in the Administrative type logs indicate a problem and a well-defined solution that an administrator can act on. An example of an administrative event is an event that occurs when an application fails to connect to a printer.

Events in an analytic event log are published in high volume. They describe program operation and indicate problems that cannot be handled by user intervention.

Events in a debug type event log are used solely by developers to diagnose a problem for debugging.

Events in an operational type event log are used for analyzing and diagnosing a problem or occurrence. They can be used to trigger tools or tasks based on the problem or occurrence. An example of an operational event is an event that occurs when a printer is added or removed from a system.

Allows you to subscribe to incoming events. Each time a desired event is published to an event log, the event is raised, and the method that handles this event will be executed.

Allows setting a delegate (event handler method) that gets called every time an event is published that matches the criteria specified in the event query for this object.

Initializes a new instance of the class by specifying an event query, a bookmark that is used as starting position for the query, and a Boolean value that determines whether to read the events that already exist in the event log.

Specifies a query for the event subscription. When an event is logged that matches the criteria expressed in the query, then the event is raised. The bookmark (placeholder) used as a starting position in the event log or stream of events. Only events that have been logged after the bookmark event will be returned by the query. A Boolean value that determines whether to read the events that already exist in the event log. If this value is , then the existing events are read and if this value is , then the existing events are not read.

Initializes a new instance of the class by specifying an event query and a bookmark that is used as starting position for the query.

Initializes a new instance of the class by specifying an event query.

Specifies a query for the event subscription. When an event is logged that matches the criteria expressed in the query, then the event is raised.

Initializes a new instance of the class by specifying the name or path to an event log.

The path or name of the event log monitor for events. If any event is logged in this event log, then the event is raised.

Releases all the resources used by this object.

Releases the unmanaged resources used by this object, and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Gets or sets a value that indicates whether this object starts delivering events to the event delegate.

when this object can deliver events to the event delegate; when this object has stopped delivery.

Contains the metadata (properties and settings) for an event that is defined in an event provider.

Gets the description template associated with the event using the current thread locale for the description language.

A string that contains the description template associated with the event.

Gets the identifier of the event that is defined in the event provider.

The event identifier.

Gets the keywords associated with the event that is defined in the event provider.

An enumerable collection of the keywords associated with the event.

Gets the level associated with the event that is defined in the event provider. The level defines the severity of the event.

The level associated with the event.

Gets a link to the event log that receives this event when the provider publishes this event.

A link to the event log.

Gets the opcode associated with this event that is defined by an event provider. The opcode defines a numeric value that identifies the activity or a point within an activity that the application was performing when it raised the event.

The opcode associated with this event.

Gets the task associated with the event. A task identifies a portion of an application or a component that publishes an event.

The task associated with the event.

Gets the template string for the event. Templates are used to describe data that is used by a provider when an event is published. Templates optionally specify XML that provides the structure of an event. The XML allows values that the event publisher provides to be inserted during the rendering of an event.

A string that contains the template for the event.

Gets the version of the event that qualifies the event identifier.

A byte value that contains the version of the event.

Contains an event opcode that is defined in an event provider. An opcode defines a numeric value that identifies the activity or a point within an activity that the application was performing when it raised the event.

Gets the localized name for an event opcode.

The localized name for an event opcode.

Gets the non-localized name for an event opcode.

The non-localized name for an event opcode.

Gets the numeric value associated with the event opcode.

The numeric value associated with the event opcode.

Contains the value of an event property that is specified by the event provider when the event is published.

Gets the value of the event property that is specified by the event provider when the event is published.

The value of the event property.

Defines the properties of an event instance for an event that is received from an object. The event properties provide information about the event such as the name of the computer where the event was logged and the time the event was created. This class is an abstract class. The class implements this class.

Initializes a new instance of the class.

Releases all the resources used by this object.

Releases the unmanaged resources used by this object, and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Gets the event message in the current locale.

Returns a string that contains the event message in the current locale.

Gets the event message, replacing variables in the message with the specified values.

The values used to replace variables in the event message. Variables are represented by %n, where n is a number. Returns a string that contains the event message in the current locale.

Gets the XML representation of the event. All of the event properties are represented in the event XML. The XML conforms to the event schema.

Returns a string that contains the XML representation of the event.

Gets the globally unique identifier (GUID) for the activity in process for which the event is involved. This allows consumers to group related activities.

Returns a GUID value.

Gets a placeholder (bookmark) that corresponds to this event. This can be used as a placeholder in a stream of events.

Returns a object.

Gets the identifier for this event. All events with this identifier value represent the same type of event.

Returns an integer value. This value can be null.

Gets the keyword mask of the event. Get the value of the property to get the name of the keywords used in this mask.

Returns a long value. This value can be null.

Gets the display names of the keywords used in the keyword mask for this event.

Returns an enumerable collection of strings that contain the display names of the keywords used in the keyword mask for this event.

Gets the level of the event. The level signifies the severity of the event. For the name of the level, get the value of the property.

Returns a byte value. This value can be null.

Gets the display name of the level for this event.

Returns a string that contains the display name of the level for this event.

Gets the name of the event log where this event is logged.

Returns a string that contains a name of the event log that contains this event.

Gets the name of the computer on which this event was logged.

Returns a string that contains the name of the computer on which this event was logged.

Returns a short value. This value can be null.

Gets the display name of the opcode for this event.

Returns a string that contains the display name of the opcode for this event.

Gets the process identifier for the event provider that logged this event.

Returns an integer value. This value can be null.

Gets the user-supplied properties of the event.

Returns a list of objects.

Gets the globally unique identifier (GUID) of the event provider that published this event.

Returns a GUID value. This value can be null.

Gets the name of the event provider that published this event.

Returns a string that contains the name of the event provider that published this event.

Gets qualifier numbers that are used for event identification.

Returns an integer value. This value can be null.

Gets the event record identifier of the event in the log.

Returns a long value. This value can be null.

Gets a globally unique identifier (GUID) for a related activity in a process for which an event is involved.

Returns a GUID value. This value can be null.

Gets a task identifier for a portion of an application or a component that publishes an event. A task is a 16-bit value with 16 top values reserved. This type allows any value between 0x0000 and 0xffef to be used. To obtain the task name, get the value of the property.

Returns an integer value. This value can be null.

Gets the display name of the task for the event.

Returns a string that contains the display name of the task for the event.

Gets the thread identifier for the thread that the event provider is running in.

Returns an integer value. This value can be null.

Gets the time, in format, that the event was created.

Returns a value. The value can be null.

Gets the security descriptor of the user whose context is used to publish the event.

Returns a value.

Gets the version number for the event.

Returns a byte value. This value can be null.

When the event is raised, an instance of this object is passed to the delegate method that handles the event. This object contains the event that was published to the event log or the exception that occurred when the event subscription failed.

Gets the exception that occurred when the event subscription failed. The exception has a description of why the subscription failed.

The exception that occurred when the event subscription failed.

Gets the event record that is published to the event log. This event matches the criteria from the query specified in the event subscription.

The event record.

Contains an event task that is defined in an event provider. The task identifies a portion of an application or a component that publishes an event. A task is a 16-bit value with 16 top values reserved.

Gets the localized name for the event task.

The localized name for the event task.

Gets the event globally unique identifier (GUID) associated with the task.

The event GUID associated with the task.

Gets the non-localized name of the event task.

The non-localized name of the event task.

Gets the numeric value associated with the task.

The numeric value associated with the task.

Specifies that a string contains a name of an event log or the file system path to an event log file.

A path parameter contains the file system path to an event log file.

A path parameter contains the name of the event log.

Contains static information about an event provider, such as the name and id of the provider, and the collection of events defined in the provider.

Initializes a new instance of the class by specifying the name of the provider that you want to retrieve information about, the event log service that the provider is registered with, and the language that you want to return the information in.

The name of the event provider that you want to retrieve information about. The object that specifies whether to get the provider information from a provider on the local computer or a provider on a remote computer. The culture that specifies the language that the information should be returned in.

Initializes a new instance of the class by specifying the name of the provider that you want to retrieve information about.

The name of the event provider that you want to retrieve information about.

Releases all the resources used by this object.

Releases the unmanaged resources used by this object, and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Gets the localized name of the event provider.

Returns a string that contains the localized name of the event provider.

Gets an enumerable collection of objects, each of which represents an event that is defined in the provider.

Returns an enumerable collection of objects.

Gets the base of the URL used to form help requests for the events in this event provider.

Returns a value.

Gets the globally unique identifier (GUID) for the event provider.

Returns the GUID value for the event provider.

Gets an enumerable collection of objects, each of which represent an event keyword that is defined in the event provider.

Returns an enumerable collection of objects.

Gets an enumerable collection of objects, each of which represent a level that is defined in the event provider.

Returns an enumerable collection of objects.

Gets an enumerable collection of objects, each of which represent a link to an event log that is used by the event provider.

Returns an enumerable collection of objects.

Gets the path of the file that contains the message table resource that has the strings associated with the provider metadata.

Returns a string that contains the path of the provider message file.

Gets the unique name of the event provider.

Returns a string that contains the unique name of the event provider.

Gets an enumerable collection of objects, each of which represent an opcode that is defined in the event provider.

Returns an enumerable collection of objects.

Gets the path of the file that contains the message table resource that has the strings used for parameter substitutions in event descriptions.

Returns a string that contains the path of the file that contains the message table resource that has the strings used for parameter substitutions in event descriptions.

Gets the path to the file that contains the metadata associated with the provider.

Returns a string that contains the path to the file that contains the metadata associated with the provider.

Gets an enumerable collection of objects, each of which represent a task that is defined in the event provider.

Returns an enumerable collection of objects.

Defines values for the type of authentication used during a Remote Procedure Call (RPC) login to a server. This login occurs when you create a object that specifies a connection to a remote computer.

Use the default authentication method during RPC login. The default authentication is equivalent to Negotiate.

Use Kerberos authentication during RPC login.

Use the Negotiate authentication method during RPC login. This allows the client application to select the most appropriate authentication method (NTLM or Kerberos) for the situation.

Use Windows NT LAN Manager (NTLM) authentication during RPC login.

Defines the standard keywords that are attached to events by the event provider. For more information about keywords, see .

Attached to all failed security audit events. This keyword should only be used for events in the Security log.

Attached to all successful security audit events. This keyword should only be used for events in the Security log.

Attached to transfer events where the related Activity ID (Correlation ID) is a computed value and is not guaranteed to be unique (not a real GUID).

Attached to events which are raised using the RaiseEvent function.

This value indicates that no filtering on keyword is performed when the event is published.

Attached to all response time events.

Attached to all Service Quality Mechanism (SQM) events.

Attached to all Windows Diagnostic Infrastructure (WDI) context events.

Attached to all Windows Diagnostic Infrastructure (WDI) diagnostic events.

Defines the standard event levels that are used in the Event Log service. The level defines the severity of the event. Custom event levels can be defined beyond these standard levels. For more information about levels, see .

This level corresponds to critical errors, which is a serious error that has caused a major failure.

This level corresponds to normal errors that signify a problem.

This level corresponds to informational events or messages that are not errors. These events can help trace the progress or state of an application.

This value indicates that not filtering on the level is done during the event publishing.

This level corresponds to lengthy events or messages.

This level corresponds to warning events. For example, an event that gets published because a disk is nearing full capacity is a warning event.

Defines the standard opcodes that are attached to events by the event provider. For more information about opcodes, see .

An event with this opcode is a trace collection start event.

An event with this opcode is a trace collection stop event.

An event with this opcode is an extension event.

An event with this opcode is an informational event.

An event with this opcode is published when one activity in an application receives data.

An event with this opcode is published after an activity in an application replies to an event.

An event with this opcode is published after an activity in an application resumes from a suspended state. The event should follow an event with the Suspend opcode.

An event with this opcode is published when one activity in an application transfers data or system resources to another activity.

An event with this opcode is published when an application starts a new transaction or activity. This can be embedded into another transaction or activity when multiple events with the Start opcode follow each other without an event with a Stop opcode.

An event with this opcode is published when an activity or a transaction in an application ends. The event corresponds to the last unpaired event with a Start opcode.

An event with this opcode is published when an activity in an application is suspended.

Defines the standard tasks that are attached to events by the event provider. For more information about tasks, see .

No task is used to identify a portion of an application that publishes an event.

Represents language-neutral information for an event log entry.

Initializes a new instance of the class using the specified resource identifiers for the localized message and category text of the event entry and the specified event log entry type.

A resource identifier that corresponds to a string defined in the message resource file of the event source. A resource identifier that corresponds to a string defined in the category resource file of the event source, or zero to specify no category for the event. An value that indicates the event type. is not a valid value. is a negative value or a value larger than UInt32.MaxValue. -or- is a negative value or a value larger than UInt16.MaxValue.

Initializes a new instance of the class using the specified resource identifiers for the localized message and category text of the event entry.

A resource identifier that corresponds to a string defined in the message resource file of the event source. A resource identifier that corresponds to a string defined in the category resource file of the event source, or zero to specify no category for the event. The parameter is a negative value or a value larger than UInt32.MaxValue. -or- The parameter is a negative value or a value larger than UInt16.MaxValue.

Gets or sets the resource identifier that specifies the application-defined category of the event entry.

The property is set to a negative value or to a value larger than UInt16.MaxValue. A numeric category value or resource identifier that corresponds to a string defined in the category resource file of the event source. The default is zero, which signifies that no category will be displayed for the event entry.

Gets or sets the event type of the event log entry.

The property is not set to a valid value. An value that indicates the event entry type. The default value is .

Gets or sets the resource identifier that designates the message text of the event entry.

The property is set to a negative value or to a value larger than UInt32.MaxValue. A resource identifier that corresponds to a string defined in the message resource file of the event source.

Provides interaction with Windows event logs.

Occurs when an entry is written to an event log on the local computer.

Initializes a new instance of the class. Does not associate the instance with any log.

Initializes a new instance of the class. Associates the instance with a log on the specified computer and creates or assigns the specified source to the .

The name of the log on the specified computer. The computer on which the log exists. The source of event log entries. The log name is . The log name is invalid. -or- The computer name is invalid.

Initializes a new instance of the class. Associates the instance with a log on the specified computer.

The name of the log on the specified computer. The computer on which the log exists. The log name is . The log name is invalid. -or- The computer name is invalid.

Initializes a new instance of the class. Associates the instance with a log on the local computer.

The name of the log on the local computer. The log name is . The log name is invalid.

Begins the initialization of an used on a form or used by another component. The initialization occurs at runtime.

is already initialized.

Removes all entries from the event log.

The event log was not cleared successfully. -or- The log cannot be opened. A Windows error code is not available. A value is not specified for the property. Make sure the log name is not an empty string. The log does not exist.

Closes the event log and releases read and write handles.

The event log's read handle or write handle was not released successfully.

Establishes a valid event source for writing localized event messages, using the specified configuration properties for the event source and the corresponding event log.

The configuration properties for the event source and its target event log. The computer name specified in is not valid. -or- The source name specified in is . -or- The log name specified in is not valid. Event log names must consist of printable characters and cannot include the characters '*', '?', or '\'. -or- The log name specified in is not valid for user log creation. The Event log names AppEvent, SysEvent, and SecEvent are reserved for system use. -or- The log name matches an existing event source name. -or- The source name specified in results in a registry key path longer than 254 characters. -or- The first 8 characters of the log name specified in are not unique. -or- The source name specified in is already registered. -or- The source name specified in matches an existing event log name. The registry key for the event log could not be opened. is .

Establishes the specified source name as a valid event source for writing entries to a log on the specified computer. This method can also be used to create a new custom log on the specified computer.

The source by which the application is registered on the specified computer. The name of the log the source's entries are written to. Possible values include Application, System, or a custom event log. If you do not specify a value, defaults to Application. The name of the computer to register this event source with, or "." for the local computer. The is not a valid computer name. -or- is an empty string ("") or . -or- is not a valid event log name. Event log names must consist of printable characters, and cannot include the characters '*', '?', or '\'. -or- is not valid for user log creation. The event log names AppEvent, SysEvent, and SecEvent are reserved for system use. -or- The log name matches an existing event source name. -or- The source name results in a registry key path longer than 254 characters. -or- The first 8 characters of match the first 8 characters of an existing event log name on the specified computer. -or- The source cannot be registered because it already exists on the specified computer. -or- The source name matches an existing event source name. The registry key for the event log could not be opened on the specified computer.

Establishes the specified source name as a valid event source for writing entries to a log on the local computer. This method can also create a new custom log on the local computer.

The source name by which the application is registered on the local computer. The name of the log the source's entries are written to. Possible values include Application, System, or a custom event log. is an empty string ("") or . -or- is not a valid event log name. Event log names must consist of printable characters, and cannot include the characters '*', '?', or '\'. -or- is not valid for user log creation. The event log names AppEvent, SysEvent, and SecEvent are reserved for system use. -or- The log name matches an existing event source name. -or- The source name results in a registry key path longer than 254 characters. -or- The first 8 characters of match the first 8 characters of an existing event log name. -or- The source cannot be registered because it already exists on the local computer. -or- The source name matches an existing event log name. The registry key for the event log could not be opened on the local computer.

Removes an event log from the specified computer.

The name of the log to delete. Possible values include: Application, Security, System, and any custom event logs on the specified computer. The name of the computer to delete the log from, or "." for the local computer. is an empty string ("") or . -or- is not a valid computer name. The registry key for the event log could not be opened on the specified computer. -or- The log does not exist on the specified computer. The event log was not cleared successfully. -or- The log cannot be opened. A Windows error code is not available.

Removes an event log from the local computer.

The name of the log to delete. Possible values include: Application, Security, System, and any custom event logs on the computer. is an empty string ("") or . The registry key for the event log could not be opened on the local computer. -or- The log does not exist on the local computer. The event log was not cleared successfully. -or- The log cannot be opened. A Windows error code is not available.

Removes the application's event source registration from the specified computer.

The name by which the application is registered in the event log system. The name of the computer to remove the registration from, or "." for the local computer. The parameter is invalid. -or- The parameter does not exist in the registry of the specified computer. -or- You do not have write access on the registry key for the event log. cannot be deleted because in the registry, the parent registry key for does not contain a subkey with the same name.

Removes the event source registration from the event log of the local computer.

The name by which the application is registered in the event log system. The parameter does not exist in the registry of the local computer. -or- You do not have write access on the registry key for the event log.

Releases the unmanaged resources used by the , and optionally releases the managed resources.

to release both managed and unmanaged resources; to release only unmanaged resources.

Ends the initialization of an used on a form or by another component. The initialization occurs at runtime.

Determines whether the log exists on the specified computer.

The log for which to search. Possible values include: Application, Security, System, other application-specific logs (such as those associated with Active Directory), or any custom log on the computer. The name of the computer on which to search for the log, or "." for the local computer. The parameter is an invalid format. Make sure you have used proper syntax for the computer on which you are searching. -or- The is or the value is empty. if the log exists on the specified computer; otherwise, .

Determines whether the log exists on the local computer.

The name of the log to search for. Possible values include: Application, Security, System, other application-specific logs (such as those associated with Active Directory), or any custom log on the computer. The logName is or the value is empty. if the log exists on the local computer; otherwise, .

Searches for all event logs on the local computer and creates an array of objects that contain the list.

You do not have read access to the registry. -or- There is no event log service on the computer. An array of type that represents the logs on the local computer.

Searches for all event logs on the given computer and creates an array of objects that contain the list.

The computer on which to search for event logs. The parameter is an invalid computer name. You do not have read access to the registry. -or- There is no event log service on the computer. An array of type that represents the logs on the given computer.

Gets the name of the log to which the specified source is registered.

The name of the event source. The name of the computer on which to look, or "." for the local computer. The name of the log associated with the specified source in the registry.

Changes the configured behavior for writing new entries when the event log reaches its maximum file size.

The overflow behavior for writing new entries to the event log. Must not be OverwriteOlder. Deprecated. Must be 0. is not a valid value. is less than one, or larger than 365. The value is not a valid log name. -or- The registry key for the event log could not be opened on the target computer.

Specifies the localized name of the event log, which is displayed in the server Event Viewer.

The fully specified path to a localized resource file. The resource identifier that indexes a localized string within the resource file. The value is not a valid log name. -or- The registry key for the event log could not be opened on the target computer. is .

Determines whether an event source is registered on a specified computer.

The name of the event source. The name the computer on which to look, or "." for the local computer. is an invalid computer name. was not found, but some or all of the event logs could not be searched. if the event source is registered on the given computer; otherwise, .

Determines whether an event source is registered on the local computer.

The name of the event source. was not found, but some or all of the event logs could not be searched. if the event source is registered on the local computer; otherwise, .

Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log, and appends binary data to the message.

The string to write to the event log. One of the values. The application-specific identifier for the event. The application-specific subcategory associated with the message. An array of bytes that holds the binary data associated with the entry. The property of the has not been set. -or- The method attempted to register a new event source, but the computer name in is not valid. -or- The source is already registered for a different event log. -or- is less than zero or greater than UInt16.MaxValue. -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. The registry key for the event log could not be opened. is not a valid . The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log.

The string to write to the event log. One of the values. The application-specific identifier for the event. The application-specific subcategory associated with the message. The property of the has not been set. -or- The method attempted to register a new event source, but the computer name in is not valid. -or- The source is already registered for a different event log. -or- is less than zero or greater than UInt16.MaxValue. -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. The registry key for the event log could not be opened. is not a valid . The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an entry with the given message text and application-defined event identifier to the event log.

The string to write to the event log. One of the values. The application-specific identifier for the event. The property of the has not been set. -or- The method attempted to register a new event source, but the computer name in is not valid. -or- The source is already registered for a different event log. -or- is less than zero or greater than UInt16.MaxValue. -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. The registry key for the event log could not be opened. is not a valid . The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an error, warning, information, success audit, or failure audit entry with the given message text to the event log.

The string to write to the event log. One of the values. The property of the has not been set. -or- The method attempted to register a new event source, but the computer name in is not valid. -or- The source is already registered for a different event log. -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. is not a valid . The registry key for the event log could not be opened. The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log (using the specified registered event source) and appends binary data to the message.

The source by which the application is registered on the specified computer. The string to write to the event log. One of the values. The application-specific identifier for the event. The application-specific subcategory associated with the message. An array of bytes that holds the binary data associated with the entry. The value is an empty string (""). -or- The value is . -or- is less than zero or greater than UInt16.MaxValue. -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. is not a valid . The registry key for the event log could not be opened. The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log, using the specified registered event source. The can be used by the Event Viewer to filter events in the log.

The source by which the application is registered on the specified computer. The string to write to the event log. One of the values. The application-specific identifier for the event. The application-specific subcategory associated with the message. The value is an empty string (""). -or- The value is . -or- is less than zero or greater than UInt16.MaxValue. -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. The registry key for the event log could not be opened. is not a valid . The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an entry with the given message text and application-defined event identifier to the event log, using the specified registered event source.

The source by which the application is registered on the specified computer. The string to write to the event log. One of the values. The application-specific identifier for the event. The value is an empty string (""). -or- The value is . -or- is less than zero or greater than UInt16.MaxValue. -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. The registry key for the event log could not be opened. is not a valid . The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an error, warning, information, success audit, or failure audit entry with the given message text to the event log, using the specified registered event source.

The source by which the application is registered on the specified computer. The string to write to the event log. One of the values. The value is an empty string (""). -or- The value is . -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. The registry key for the event log could not be opened. is not a valid . The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an information type entry with the given message text to the event log, using the specified registered event source.

The source by which the application is registered on the specified computer. The string to write to the event log. The value is an empty string (""). -or- The value is . -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. The registry key for the event log could not be opened. The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an information type entry, with the given message text, to the event log.

The string to write to the event log. The property of the has not been set. -or- The method attempted to register a new event source, but the computer name in is not valid. -or- The source is already registered for a different event log. -or- The message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista). -or- The source name results in a registry key path longer than 254 characters. The registry key for the event log could not be opened. The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an event log entry with the given event data, message replacement strings, and associated binary data.

An instance that represents a localized event log entry. An array of bytes that holds the binary data associated with the entry. An array of strings to merge into the message text of the event log entry. The property of the has not been set. -or- The method attempted to register a new event source, but the computer name in is not valid. -or- The source is already registered for a different event log. -or- is less than zero or greater than UInt16.MaxValue. -or- has more than 256 elements. -or- One of the elements is longer than 32766 bytes. -or- The source name results in a registry key path longer than 254 characters. is . The registry key for the event log could not be opened. The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes a localized entry to the event log.

An instance that represents a localized event log entry. An array of strings to merge into the message text of the event log entry. The property of the has not been set. -or- The method attempted to register a new event source, but the computer name in is not valid. -or- The source is already registered for a different event log. -or- is less than zero or greater than UInt16.MaxValue. -or- has more than 256 elements. -or- One of the elements is longer than 32766 bytes. -or- The source name results in a registry key path longer than 254 characters. is . The registry key for the event log could not be opened. The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an event log entry with the given event data, message replacement strings, and associated binary data, and using the specified registered event source.

The name of the event source registered for the application on the specified computer. An instance that represents a localized event log entry. An array of bytes that holds the binary data associated with the entry. An array of strings to merge into the message text of the event log entry. The value is an empty string (""). -or- The value is . -or- is less than zero or greater than UInt16.MaxValue. -or- has more than 256 elements. -or- One of the elements is longer than 32766 bytes. -or- The source name results in a registry key path longer than 254 characters. is . The registry key for the event log could not be opened. The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Writes an event log entry with the given event data and message replacement strings, using the specified registered event source.

The name of the event source registered for the application on the specified computer. An instance that represents a localized event log entry. An array of strings to merge into the message text of the event log entry. The value is an empty string (""). -or- The value is . -or- is less than zero or greater than UInt16.MaxValue. -or- has more than 256 elements. -or- One of the elements is longer than 32766 bytes. -or- The source name results in a registry key path longer than 254 characters. is . The registry key for the event log could not be opened. The operating system reported an error when writing the event entry to the event log. A Windows error code is not available.

Gets or sets a value indicating whether the receives event notifications.

The event log is on a remote computer. if the receives notification when an entry is written to the log; otherwise, .

Gets the contents of the event log.

An holding the entries in the event log. Each entry is associated with an instance of the class.

Gets or sets the name of the log to read from or write to.

The name of the log. This can be Application, System, Security, or a custom log name. The default is an empty string ("").

Gets the event log's friendly name.

The specified does not exist in the registry for this computer. A name that represents the event log in the system's event viewer.

Gets or sets the name of the computer on which to read or write events.

The computer name is invalid. The name of the server on which the event log resides. The default is the local computer (".").

Gets or sets the maximum event log size in kilobytes.

The specified value is less than 64, or greater than 4194240, or not an even multiple of 64. The value is not a valid log name. -or- The registry key for the event log could not be opened on the target computer. The maximum event log size in kilobytes. The default is 512, indicating a maximum file size of 512 kilobytes.

This property is deprecated.

Gets the configured behavior for storing new entries when the event log reaches its maximum log file size.

The value that specifies the configured behavior for storing new entries when the event log reaches its maximum log size. The default is .

Gets or sets the source name to register and use when writing to the event log.

The source name results in a registry key path longer than 254 characters. The name registered with the event log as a source of entries. The default is an empty string ("").

Gets or sets the object used to marshal the event handler calls issued as a result of an entry written event.

The used to marshal event-handler calls issued as a result of an event on the event log.

Encapsulates a single record in the event log. This class cannot be inherited.

Performs a comparison between two event log entries.

The to compare. if the objects are identical; otherwise, .

Populates a with the data needed to serialize the target object.

The to populate with data. The destination (see ) for this serialization.

Gets the text associated with the property for this entry.

The space could not be allocated for one of the insertion strings associated with the category. The application-specific category text.

Gets the category number of the event log entry.

The application-specific category number for this entry.

Gets the binary data associated with the entry.

An array of bytes that holds the binary data associated with the entry.

Gets the event type of this entry.

The event type that is associated with the entry in the event log.

Gets the application-specific event identifier for the current event entry.

The application-specific identifier for the event message.

Gets the index of this entry in the event log.

The index of this entry in the event log.

Gets the resource identifier that designates the message text of the event entry.

A resource identifier that corresponds to a string definition in the message resource file of the event source.

Gets the name of the computer on which this entry was generated.

The name of the computer that contains the event log.

Gets the localized message associated with this event entry.

The space could not be allocated for one of the insertion strings associated with the message. The formatted, localized text for the message. This includes associated replacement strings.

Gets the replacement strings associated with the event log entry.

An array that holds the replacement strings stored in the event entry.

Gets the name of the application that generated this event.

The name registered with the event log as the source of this event.

Gets the local time at which this event was generated.

The local time at which this event was generated.

Gets the local time at which this event was written to the log.

The local time at which this event was written to the log.

Gets the name of the user who is responsible for this event.

Account information could not be obtained for the user's SID. The security identifier (SID) that uniquely identifies a user or group.

Defines size and enumerators for a collection of instances.

Copies the elements of the to an array of instances, starting at a particular array index.

The one-dimensional array of instances that is the destination of the elements copied from the collection. The array must have zero-based indexing. The zero-based index in the array at which copying begins.

Supports a simple iteration over the object.

An object that can be used to iterate over the collection.

Copies the elements of the collection to an , starting at a particular index.

The one-dimensional that is the destination of the elements that are copied from the collection. The must have zero-based indexing. The zero-based index in at which copying begins.

Gets the number of entries in the event log (that is, the number of elements in the collection).

The number of entries currently in the event log.

Gets an entry in the event log, based on an index that starts at 0 (zero).

The zero-based index that is associated with the event log entry. The event log entry at the location that is specified by the parameter.

Gets a value that indicates whether access to the is synchronized (thread-safe).

if access to the collection is not synchronized (thread-safe).

Gets an object that can be used to synchronize access to the object.

An object that can be used to synchronize access to the collection.

Specifies the event type of an event log entry.

An error event. This indicates a significant problem the user should know about; usually a loss of functionality or data.

A failure audit event. This indicates a security event that occurs when an audited access attempt fails; for example, a failed attempt to open a file.

An information event. This indicates a significant, successful operation.

A success audit event. This indicates a security event that occurs when an audited access attempt is successful; for example, logging on successfully.

A warning event. This indicates a problem that is not immediately significant, but that may signify conditions that could cause future problems.

Provides a simple listener that directs tracing or debugging output to an .

Initializes a new instance of the class without a trace listener.

Initializes a new instance of the class using the specified event log.

The event log to write to.

Initializes a new instance of the class using the specified source.

The name of an existing event log source.

Closes the event log so that it no longer receives tracing or debugging output.

Writes trace information, a data object, and event information to the event log.

An object that contains the current process ID, thread ID, and stack trace information. A name used to identify the output; typically the name of the application that generated the trace event. One of the enumeration values that specifies the type of event that has caused the trace. A numeric identifier for the event. The combination of and uniquely identifies an event. A data object to write to the output file or stream. is not specified. -or- The log entry string exceeds 32,766 characters.

Writes trace information, an array of data objects, and event information to the event log.

An object that contains the current process ID, thread ID, and stack trace information. A name used to identify the output; typically the name of the application that generated the trace event. One of the enumeration values that specifies the type of event that has caused the trace. A numeric identifier for the event. The combination of and uniquely identifies an event. An array of data objects. is not specified. -or- The log entry string exceeds 32,766 characters.

Writes trace information, a formatted array of objects, and event information to the event log.

An object that contains the current process ID, thread ID, and stack trace information. A name used to identify the output; typically the name of the application that generated the trace event. One of the enumeration values that specifies the type of event that has caused the trace. A numeric identifier for the event. The combination of and uniquely identifies an event. A format string that contains zero or more format items that correspond to objects in the array. An array containing zero or more objects to format. is not specified. -or- The log entry string exceeds 32,766 characters.

Writes trace information, a message, and event information to the event log.

An object that contains the current process ID, thread ID, and stack trace information. A name used to identify the output; typically the name of the application that generated the trace event. One of the enumeration values that specifies the type of event that has caused the trace. A numeric identifier for the event. The combination of and uniquely identifies an event. The trace message. is not specified. -or- The log entry string exceeds 32,766 characters.

Writes a message to the event log for this instance.

The message to write. exceeds 32,766 characters.

Writes a message to the event log for this instance.

The message to write. exceeds 32,766 characters.

Gets or sets the event log to write to.

The event log to write to.

Gets or sets the name of this .

The name of this trace listener.

Represents the configuration settings used to create an event log source on the local computer or a remote computer.

Initializes a new instance of the class with a specified event source and event log name.

The name to register with the event log as a source of entries. The name of the log to which entries from the source are written.

Gets or sets the number of categories in the category resource file.

The property is set to a negative value or to a value larger than UInt16.MaxValue. The number of categories in the category resource file. The default value is zero.

Gets or sets the path of the resource file that contains category strings for the source.

The path of the category resource file. The default is an empty string ("").

Gets or sets the name of the event log to which the source writes entries.

The name of the event log. This can be Application, System, or a custom log name. The default value is "Application."

Gets or sets the name of the computer on which to register the event source.

The computer name is invalid. The name of the system on which to register the event source. The default is the local computer (".").

Gets or sets the path of the message resource file that contains message formatting strings for the source.

The path of the message resource file. The default is an empty string ("").

Gets or sets the path of the resource file that contains message parameter strings for the source.

The path of the parameter resource file. The default is an empty string ("").

Gets or sets the name to register with the event log as an event source.

The name to register with the event log as a source of entries. The default is an empty string ("").

Specifies how to handle entries in an event log that has reached its maximum file size.

Indicates that existing entries are retained when the event log is full and new entries are discarded.

Indicates that each new entry overwrites the oldest entry when the event log is full.

This field is deprecated.