Programmatically create a custom Eventlog view

Question

I want to programmatically create a custom Eventlog view in a C# application.

This is how to create a custom Eventlog view with the help of the Eventlog application from Microsoft Windows:

create custom view

I searched the class System.Diagnostics.EventLog for a method that does the same as the button found in the Eventlog Application from Microsoft. Sadly, i couldn't find any functionality that covers my needs.

Has anyone ever programmatically created a custom Eventlog view in C# or knows a way that works?

What exactly DOES this button do? (maybe even a screenshot of what it does would be good to see there to help — Thomas
– Thomas, Commented Apr 17, 2015 at 9:29
@Thomas Sadly I can't add an image to my post since my reputation is to low. Here's an image of this button — Dominik B
– Dominik B, Commented Apr 17, 2015 at 9:31

Marco · Accepted Answer · 2015-04-17 09:53:34Z

7

If just tested the approach found here:

try
{
    XmlTextWriter view = new XmlTextWriter("C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\View_1.xml", Encoding.Unicode);
    // Root.
    view.WriteStartDocument();
    view.WriteStartElement("ViewerConfig");
    //Create Node for queryConfig
    view.WriteStartElement("QueryConfig");
    view.WriteStartElement("QueryParams");
    view.WriteStartElement("UserQuery");
    view.WriteEndElement();
    view.WriteEndElement();
    //QueryNode
    view.WriteStartElement("QueryNode");
    //....

    view.Close();
}
catch (XmlException ex)
{
    Console.WriteLine(ex.StackTrace);
}

This created a custom view for me. enter image description here

Basically, custom views are xml files stored under C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ and you can just roll you own, by creating an xml document.

If you want to know how to format such an xml document, you can always fall back to the already pre defined querys in the Server Roles folder under C:\ProgramData\Microsoft\Event Viewer\Views\ServerRoles

answered Apr 17, 2015 at 9:53

Marco

24.1k13 gold badges81 silver badges132 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Dominik B Over a year ago

Thanks, this worked great. However, now that I know that there's the folder with the .xml files, I'll probably just create the .xml beforehand and just move it to the folder programmatically.

Marco Over a year ago

I would do it that way too. It could come in handy when issuing out requested VMs and run configuration scripts to create those views.

westwood · Accepted Answer · 2015-04-17 09:52:02Z

1

Possible solution is:

Create a desired custom view using eventvwr.msc interface (shown on image provided by you).
Export it to a .xml file and study/make little research about it's structure
Write a code to generate such .xml file based on your needs or use already crafted and exported only replacing appropriate "placeholders" (event codes, event sources, etc.)
Run eventvwr.exe with /v option like eventvwr.exe /v:MyView.xml (more options using eventvwr.exe /?)

answered Apr 17, 2015 at 9:52

westwood

1,78416 silver badges31 bronze badges

1 Comment

Dominik B Over a year ago

This is basically the same approach that Serv used, which worked. Thanks.

Collectives™ on Stack Overflow

Programmatically create a custom Eventlog view

2 Answers 2

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related