Read Event Log file (.evt) using C# throw Data is not valid

Question

I try read a Event Log file .evt file from C#, and using a filter to only get the Framework 2.0 entries:

string query = "*[System/Provider/@Name=\"ASP.NET 2.0.50727.0\"]"; 

var elQuery = new EventLogQuery("C:\evento.evt", PathType.FilePath, query);
var elReader = new System.Diagnostics.Eventing.Reader.EventLogReader(elQuery);

List<EventRecord> eventList = new List<EventRecord>();

for (EventRecord eventInstance = elReader.ReadEvent(); null != eventInstance; eventInstance = elReader.ReadEvent())
{
    string source = eventInstance.ProviderName;

    eventList.Add(eventInstance);
    if (eventInstance.Properties.Count > 3)
    {
        string dateTime = eventInstance.Properties[2].Value.ToString(); 
        string message = eventInstance.Properties[1].Value.ToString();
    }
}

If I put a breakpoint, I see correct result for a few of Event Log entries, but if I press F5, elReader.ReadEvent() throw the error Data is not valid

Any Help? Thanks!

Rhumborl · Accepted Answer · 2016-05-26 15:35:20Z

2

In a for loop, the condition is not checked until after the iteration. So here, elReader.ReadEvent() will return null, and set that in eventInstance. Then the loop body will run, then it will check if eventInstance is null and stop.

The normal way to do this sort of read until null loop is to use a while loop instead, where you set the variable and check the condition at the same time:

while ((EventRecord eventInstance = elReader.ReadEvent()) != null)
{
  // as before
}

This will set eventInstance from ReadEvent() as before, but check if that returned null before running the body of the loop.

The classic other place this pattern is used in .NET is reading lines in a text file, e.g. see this example on MSDN

answered May 26, 2016 at 15:35

Rhumborl

16.7k4 gold badges41 silver badges47 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Francisco Lopez · Accepted Answer · 2021-02-05 21:43:12Z

0

public static void LeerPrint() {

        string logType = "Microsoft-Windows-PrintService/Operational";
        string query = "*[System/EventID=307]";

        var elQuery = new
            EventLogQuery(logType, PathType.LogName, query);
        var elReader = new EventLogReader(elQuery);

        for (EventRecord eventInstance = elReader.ReadEvent(); eventInstance != null; eventInstance = elReader.ReadEvent())
        {
            string source = eventInstance.ProviderName;
            Class1.WriteLog("1:"+eventInstance.Properties[1].Value.ToString() , config.validadirectorio());
            Class1.WriteLog("2:" + eventInstance.Properties[2].Value.ToString(), config.validadirectorio());
            Class1.WriteLog("3:" + eventInstance.Properties[3].Value.ToString(), config.validadirectorio());
            Class1.WriteLog("4:" + eventInstance.Properties[4].Value.ToString(), config.validadirectorio());
            Class1.WriteLog("5:" + eventInstance.Properties[5].Value.ToString(), config.validadirectorio());
            Class1.WriteLog("6:" + eventInstance.Properties[6].Value.ToString(), config.validadirectorio());
            Class1.WriteLog("7:" + eventInstance.Properties[7].Value.ToString(), config.validadirectorio());

            
        }


    }

answered Feb 5, 2021 at 21:43

Francisco Lopez

1

1 Comment

Connor Low Over a year ago

Hi Francisco, thanks for your answer. This could be improved by adding details of how/why this addresses the problem in the question. Try to remember, you aren't solving one person's problem here and now, but for all users of all time who might stumble upon this question. Details are important!

Collectives™ on Stack Overflow

Read Event Log file (.evt) using C# throw Data is not valid

2 Answers 2

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related