0

We are using EventLog to log exceptions. there is a background thread which check once the eventlog get full and programmaticaly transfers the entries into an XML file and then clear the event log.

This works fine but it seems like there is too much work getting done, I thought it would be better to simply copy the .evt file used for logging the current application and then clear the event log.

is there any way to find the location/path of the file which will work on every windows OS?

its suggested to use 

Registry.LocalMachine.OpenSubKey("System\\CurrentControlSet\\Services\\EventLog\\" + e.Log);

but then my application log names dont have a File property.

Mithir
  • 2,355
  • 2
  • 25
  • 37

1 Answers1

2

How are you archiving them now? Maybe that method can be improved to gain performance.

Here's an example.

EventLogSession els = new EventLogSession();
els.ExportLogAndMessages("Security",             // Log Name to archive
                         PathType.LogName,       // Type of Log
                         "*",                    // Query selecting all events
                         "C:\\archivedLog.evtx", // Exported Log Path 
                         false,                  // Stop archive if query is invalid
                         CultureInfo.CurrentCulture);

Or you can use the ClearLog() method.

EventLogSession els = new EventLogSession();

// Clears all the events and archives them to the .evtx file
els.ClearLog("System",          //  Channel to Clear
             "c:\\myLog.evtx"); //  Backup File Path

More information can be found here:

Export, Archive, and Clear Event Logs

Christophe Geers
  • 8,564
  • 3
  • 37
  • 53
  • Thanks this is very helpful. it looks like the ClearLog method is very simple to use, I noticed you mentioned performance, is ClearLog the best option Performance-wise? Its important to me because performance is the main reason for this change. – Mithir Jun 21 '12 at 08:16
  • Don't know, but I would certainly compare it to whatever implementation you have now. – Christophe Geers Jun 21 '12 at 08:33