7

From windows event viewer I can get the following xml structure:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
  <Provider Name="XXXXXXXXXX" Guid="{YYYYYYYY}" /> 
  <EventID>XYZ</EventID> 
  <Version>0</Version> 
  <Level>L</Level> 
  <Task>A</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x000xyzh</Keywords> 
  <TimeCreated SystemTime="2012-06-28T15:44:04.997837000Z" /> 
  <EventRecordID>153</EventRecordID> 
  <Correlation ActivityID="{DDDDDDDDD}" /> 
  <Execution ProcessID="199999" ThreadID="90990" /> 
  <Channel>Microsoft-Windows-ABCDEFG/Admin</Channel> 
  <Computer>myPC</Computer> 
  <Security UserID="ABCABC" /> 
  </System>
<EventData>
  <Data Name="name1">data1</Data> 
  <Data Name="name2">data2</Data> 
  <Data Name="name3">data3</Data> 
</EventData>
<RenderingInfo Culture="en-US">
  <Message>some message </Message> 
  <Level>Information</Level> 
  <Task>XYZ</Task> 
  <Opcode>Info</Opcode> 
  <Channel /> 
  <Provider /> 
  <Keywords>
  <Keyword>XYZ</Keyword> 
  </Keywords>
</RenderingInfo>
</Event>

I am only interested in the EventData section of the xml. I have created the following very simple classes:

   public class Event
    {
        public EventData EventData;

    }

    public class EventData
    {
        public String[] Data;
    }

I then use the following code:

XmlSerializer serializer = new XmlSerializer(typeof(Event));
StringReader reader = new StringReader(evtXml);
evt = (Event)serializer.Deserialize(reader);

but on the first line of code, I get the following error:

There is an error in XML document (1, 2).

This error is not informative to me. Is the problem that I don't have all the fields in the classes or do I need some other class (other than XmlSerializer) to get the data from. The way I would like the data under the EventData is by name and data value (e.g name1 with data1) ...etc

Important EDIT: the xml I am getting is generated by the ToXML() method of the EventRecord class

Thanks

Saher Ahwal
  • 9,015
  • 32
  • 84
  • 152
  • 2
    Well the XML document *isn't* valid - look at the `Message` tag: `some message `. If this isn't your real XML, please include a short but complete piece of XML which demonstrates the same problem. – Jon Skeet Jun 28 '12 at 18:51
  • @JonSkeet : I am getting the xml from toXML() method of Event Record class – Saher Ahwal Jun 28 '12 at 19:18
  • why would this method http://msdn.microsoft.com/en-us/library/system.diagnostics.eventing.reader.eventrecord.toxml.aspx return bad xml – Saher Ahwal Jun 28 '12 at 19:18
  • I *very* much doubt that's the exact XML you got from `EventRecord.ToXml`. – Jon Skeet Jun 28 '12 at 19:19
  • I cannot put the actual content in xml, some information is not supposed to be shown sorry. So the problem is with the xml itself? – Saher Ahwal Jun 28 '12 at 19:28
  • Well we can't really tell - you've given us invalid XML, and an error saying that the XML is invalid... but if that's not the *actual* XML, that makes it harder to diagnose, doesn't it? That's why it's important to have a short but *complete* program demonstrating the problem. It doesn't have to be "production" data - but it has to be real data that demonstrates the problem. It looks like it's now fixed for this case, but please take this on board for the next time you ask a question. – Jon Skeet Jun 28 '12 at 20:28
  • I sure will. Thanks for your help. I appreciate your advice thanks.\ – Saher Ahwal Jun 28 '12 at 20:42

2 Answers2

7
XmlSerializer serializer = new XmlSerializer(typeof(Event),
        "http://schemas.microsoft.com/win/2004/08/events/event");

StringReader reader = new StringReader(evtXml);
var evt = (Event)serializer.Deserialize(reader);
public class Event
{
    public Data[] EventData;
}

public class Data
{
    [XmlAttribute]
    public string Name;

    [XmlText]
    public string Value;
}
Markus Jarderot
  • 86,735
  • 21
  • 136
  • 138
  • That worked for me. what was the issue with adding http://schemas.microsoft.com/win/2004/08/events/event and which got rid of the error. – Saher Ahwal Jun 28 '12 at 19:45
  • Hey Markus, how can I get value of complex data under EventData, how to define the classes? See xml here: http://stackoverflow.com/questions/11368636/reading-windows-event-payload-including-complex-data – Saher Ahwal Jul 06 '12 at 20:30
3

XmlSerializer often tells you what the matte is; add some error handling, specifically:

try {
   // your code
} catch(Exception ex) {
    while(ex != null) {
        Console.WriteLine(ex.Message);
        ex = ex.InnerException;
    }
}

I'm guessing it is a namespace issue; try:

[XmlRoot("Event",
    Namespace="http://schemas.microsoft.com/win/2004/08/events/event")]
public class Event {...}
Marc Gravell
  • 1,026,079
  • 266
  • 2,566
  • 2,900
  • @Saher fair enough, but please do look at the inner exceptions in future - it usually does do a very good job of explaining the problem – Marc Gravell Jun 28 '12 at 19:47