EventLogQuery: How to form query string?

Question

I have the following code:

string query = "???";

EventLogQuery elq = new EventLogQuery("Application", PathType.LogName, query);
elq.Session = new EventLogSession("x.x.x.x");
EventLogReader elr = new EventLogReader(elq);

I'm trying to figure out what I need to set query to in order to look for all entries with a source of "SQLSERVERAGENT".

If I use Event Viewer to set a filter, I can see the raw XML query it's using. I get a string like ``. Does any of this work (the whole thing, minus the XML tag, or just `Provider[@Name='...']`? — lc., Sep 12 '12 at 01:57
would [C#: How to Query for an event log details with a given event id?](http://stackoverflow.com/questions/2462426/c-how-to-query-for-an-event-log-details-with-a-given-event-id) helps ? — Turbot, Sep 12 '12 at 02:05
I think [this post is your answer][1]. [1]: http://stackoverflow.com/a/8575390/284758 — Brent Arias, Sep 12 '12 at 02:38
Thanks, I actually found that question too after posting this and it needs to be: *[System/Provider/@Name=\"SQLSERVERAGENT\" — Brandon Moore, Sep 12 '12 at 02:41
However, I am now befuddled about how to read the message. There are all kinds of properties with various info about the event... but no property for the actual Message string that I can see??? — Brandon Moore, Sep 12 '12 at 02:42
@lc. See new question here: http://stackoverflow.com/questions/12380601/eventlogreader-and-eventrecord-wheres-the-message — Brandon Moore, Sep 12 '12 at 02:56
Tl;dr [XPath](https://developer.mozilla.org/en-US/docs/Web/XPath) — Liam, May 15 '19 at 10:14
Possible duplicate of [C#: How to Query for an event log details with a given event id?](https://stackoverflow.com/questions/2462426/c-how-to-query-for-an-event-log-details-with-a-given-event-id) — Liam, May 15 '19 at 10:15

score 5 · Answer 1 · edited Mar 18 '20 at 07:46

I have just spent an hour trying to solve similar for myself and thought I would contribute back with the solution for anyone else that comes this way. The comments should be fairly self explanatory.

public void ReadSqlAgentEventMessages()
{
    // Force culture to en-US if required, some people get a null from FormatDescription() and this appently solves it. 
    // My culture is set as en-GB and I did not have the issue, so I have left it as a comment to possibly ease someone's pain!
    // Thread.CurrentThread.CurrentCulture = new CultureInfo("en-US");

    EventLogQuery eventlogQuery = new EventLogQuery("Application", PathType.LogName, "*[System/Provider/@Name=\"SQLSERVERAGENT\"]");
    using (EventLogReader eventlogReader = new EventLogReader(eventlogQuery))
    {
        EventRecord eventRecord = eventlogReader.ReadEvent();
        try
        {

            // Loop through the events returned
            for (null != eventRecord; eventRecord = eventlogReader.ReadEvent())
            {
                // Get the description from the eventrecord. 
                string message = eventRecord.FormatDescription();

                // Do something cool with it :) 
            }
        }
        finally
        {
            if (eventRecord != null)
                eventRecord.Dispose();
        }
    }
}

Thanks @Liam, feel free to edit with mods. The aim of my answer was to give the simplest code possible to a rather niggly problem, but yes, using or disposings are needed. This was some time ago, there are probably better options to explore too. — Murray Foxcroft, Mar 17 '20 at 20:23

EventLogQuery: How to form query string?

1 Answers1

Linked