[DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Auto)]
static extern bool BackupEventLog(IntPtr hEventLog, string backupFile);
Declare Function BackupEventLog Lib "advapi32.dll" (TODO) As TODO
None.
EventLogSession from the namespace System.Diagnostics.Eventing.Reader can be used in most cases (Windows Vista and above only and .NET 4 or above. This throws a PlatformNotSupportedException on Windows XP and Windows 2003 with .NET 4)
To save the 'Appllication' event log:
EventLogSession eventLogSession = new EventLogSession();
eventLogSession.ExportLogAndMessages("Application", PathType.LogName, "", @"logFile.evtx", /tolerateQueryErrors*/ false, CultureInfo.CurrentCulture);
None.
Please add some!
Save the application log to disk:
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
static extern bool BackupEventLog(IntPtr hEventLog, string backupFile);
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
static extern IntPtr OpenEventLog(string lpUNCServerName, string lpSourceName);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool CloseEventLog(IntPtr hEventLog);
SaveLog()
{
IntPtr logHandle = OpenEventLog(null, "Application");
BackupEventLog(logHandle, @"c:\logfile.evtx");
CloseEventLog(logHandle);
}