EventLog 类

定义

提供与 Windows 事件日志的交互。Provides interaction with Windows event logs.

public ref class EventLog : System::ComponentModel::Component, System::ComponentModel::ISupportInitialize
public class EventLog : System.ComponentModel.Component, System.ComponentModel.ISupportInitialize
type EventLog = class
    inherit Component
    interface ISupportInitialize
Public Class EventLog
Inherits Component
Implements ISupportInitialize
继承
实现

示例

下面的示例创建事件源 MySource (如果它尚不存在),并将项写入事件日志 MyNewLogThe following example creates the event source MySource if it doesn't already exist, and writes an entry to the event log MyNewLog.

备注

从 Windows Vista 开始,你必须以管理员身份运行此应用程序。Starting with Windows Vista, you must run this application as an administrator.

#using <System.dll>

using namespace System;
using namespace System::Diagnostics;
using namespace System::Threading;
int main()
{
   
   // Create the source, if it does not already exist.
   if (  !EventLog::SourceExists( "MySource" ) )
   {
      //An event log source should not be created and immediately used.
      //There is a latency time to enable the source, it should be created
      //prior to executing the application that uses the source.
      //Execute this sample a second time to use the new source.
      EventLog::CreateEventSource( "MySource", "MyNewLog" );
      Console::WriteLine( "CreatingEventSource" );
      // The source is created.  Exit the application to allow it to be registered.
      return 0;
   }

   
   // Create an EventLog instance and assign its source.
   EventLog^ myLog = gcnew EventLog;
   myLog->Source = "MySource";
   
   // Write an informational entry to the event log.    
   myLog->WriteEntry( "Writing to event log." );
}

using System;
using System.Diagnostics;
using System.Threading;
              
class MySample{

    public static void Main(){
    
        // Create the source, if it does not already exist.
        if(!EventLog.SourceExists("MySource"))
        {
             //An event log source should not be created and immediately used.
             //There is a latency time to enable the source, it should be created
             //prior to executing the application that uses the source.
             //Execute this sample a second time to use the new source.
            EventLog.CreateEventSource("MySource", "MyNewLog");
            Console.WriteLine("CreatedEventSource");
            Console.WriteLine("Exiting, execute the application a second time to use the source.");
            // The source is created.  Exit the application to allow it to be registered.
            return;
        }
                
        // Create an EventLog instance and assign its source.
        EventLog myLog = new EventLog();
        myLog.Source = "MySource";
        
        // Write an informational entry to the event log.    
        myLog.WriteEntry("Writing to event log.");
        
    }
}
   
Option Explicit
Option Strict

Imports System.Diagnostics
Imports System.Threading

Class MySample
    Public Shared Sub Main()
        
        If Not EventLog.SourceExists("MySource") Then
            ' Create the source, if it does not already exist.
            ' An event log source should not be created and immediately used.
            ' There is a latency time to enable the source, it should be created
            ' prior to executing the application that uses the source.
            ' Execute this sample a second time to use the new source.
            EventLog.CreateEventSource("MySource", "MyNewLog")
            Console.WriteLine("CreatingEventSource")
            'The source is created.  Exit the application to allow it to be registered.
            Return
        End If
        
        ' Create an EventLog instance and assign its source.
        Dim myLog As New EventLog()
        myLog.Source = "MySource"
        
        ' Write an informational entry to the event log.    
        myLog.WriteEntry("Writing to event log.")
    End Sub
End Class

注解

EventLog 允许你访问或自定义 Windows 事件日志,这些日志记录有关重要软件或硬件事件的信息。EventLog lets you access or customize Windows event logs, which record information about important software or hardware events. 使用 EventLog,可以从现有日志读取、将条目写入日志、创建或删除事件源、删除日志以及响应日志条目。Using EventLog, you can read from existing logs, write entries to logs, create or delete event sources, delete logs, and respond to log entries. 你还可以在创建事件源时创建新日志。You can also create new logs when creating an event source.

重要

此类型实现 IDisposable 接口。This type implements the IDisposable interface. 在使用完类型后,您应直接或间接释放类型。When you have finished using the type, you should dispose of it either directly or indirectly. 若要直接释放类型,请在 try/catch 块中调用其 Dispose 方法。To dispose of the type directly, call its Dispose method in a try/catch block. 若要间接释放类型,请使用 using(在 C# 中)或 Using(在 Visual Basic 中)等语言构造。To dispose of it indirectly, use a language construct such as using (in C#) or Using (in Visual Basic). 有关详细信息,请参阅 IDisposable 接口主题中的“使用实现 IDisposable 的对象”一节。For more information, see the "Using an Object that Implements IDisposable" section in the IDisposable interface topic.

除了提供对单个事件日志及其条目的访问权限外,EventLog 类还允许您访问所有事件日志的集合。In addition to providing access to individual event logs and their entries, the EventLog class lets you access the collection of all event logs. 您可以使用 EventLogstatic 成员删除日志、获取日志列表、创建或删除源,或确定计算机是否已包含特定的源。You can use the static members of EventLog to delete logs, get log lists, create or delete a source, or determine if a computer already contains a particular source.

有三个默认的事件日志:应用程序、系统和安全性。There are three default event logs: Application, System, and Security. 安全日志为只读。A Security log is read-only. 安装的其他应用程序和服务(如 Active Directory)可能具有其他事件日志。Other applications and services you install, such as Active Directory, might have additional event logs.

使用 EventLog 类时,有一些安全注意事项。There are security considerations when using the EventLog class. EventLog 要求 EventLogPermission 在 .NET Framework 2.0 及更高版本中执行特定操作的权限,或者 .NET Framework 1.0 和1.1 中的完全信任。EventLog requires EventLogPermission permissions for specific actions in the .NET Framework 2.0 and later versions, or full trust in the .NET Framework 1.0 and 1.1. 建议不要将 EventLogPermission 授予部分受信任的代码。We recommend that EventLogPermission not be granted to partially trusted code. 绝不应将任何事件日志对象(包括 EventLogEntryCollectionEventLogEntry 对象)传递给不太受信任的代码。You should never pass any event log object, including EventLogEntryCollection and EventLogEntry objects, to less trusted code. 例如,创建 EventLog 对象、写入项,然后将 EventLog 对象传递给部分受信任的代码可能会导致安全问题,因为读取和写入事件日志的功能允许代码执行一些操作,例如发出事件日志其他应用程序的名称中的消息。For example, creating an EventLog object, writing an entry, and then passing the EventLog object to partially trusted code can create a security issue, because the ability to read and write to the event log allows code to perform actions such as issuing event log messages in the name of another application.

从 Windows Vista 开始,用户帐户控制(UAC)决定用户的凭据。Starting with Windows Vista, User Account Control (UAC) determines the credentials of a user. 如果您是内置的 Administrators 组的成员,将为您分配两个运行时访问令牌:一个标准用户访问令牌和一个管理员访问令牌。If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. 默认情况下,您拥有标准用户角色。By default, you are in the standard user role. 若要运行访问安全日志的代码,必须首先将你的凭据从标准用户提升为管理员。To run the code that accesses the Security log, you must first elevate your credentials from standard user to administrator. 你可以在启动应用程序时执行此操作(如果你使用的是鼠标,右键单击应用程序图标),并指示你希望以管理员身份运行。You can do this when you start an application by opening the shortcut menu for the application (if you're using a mouse, right-click the application icon) and indicating that you want to run as an administrator.

您可以使用 EventLog 来创建可通过服务器的事件查看器查看的自定义事件日志。You can use EventLog to create custom event logs that you can view through the server's Event Viewer. 使用 RegisterDisplayName 方法可在事件查看器中显示事件日志的本地化名称。Use the RegisterDisplayName method to display a localized name for your event log in the Event Viewer. 使用 ModifyOverflowPolicy 方法可在事件日志达到其最大日志大小时配置其行为。Use the ModifyOverflowPolicy method to configure the behavior of your event log when it reaches its maximum log size.

若要从事件日志中读取,请指定日志名称(Log 属性)和服务器计算机名称(事件日志的MachineName 属性。To read from an event log, specify the log name (Log property) and server computer name (MachineName property for the event log. 如果未指定服务器计算机名称,则假定为本地计算机 "."。If you don't specify the server computer name, the local computer, ".", is assumed. 不需要指定事件源(Source 属性),因为只需要将源写入日志。It's not necessary to specify the event source (Source property), because a source is required only for writing to logs. Entries 属性会自动填充事件日志的条目列表。The Entries property is automatically populated with the event log's list of entries.

若要写入事件日志,请指定或创建事件源(Source 属性)。To write to an event log, specify or create an event source (Source property). 您必须具有计算机上的管理凭据才能创建新的事件源。You must have administrative credentials on the computer to create a new event source. 事件源会将事件日志中的应用程序注册为条目的有效源。The event source registers your application with the event log as a valid source of entries. 您可以使用事件源一次只写入一个日志。You can use the event source to write to only one log at a time. Source 属性可以是任意随机字符串,但该名称必须与计算机上的其他源不同。The Source property can be any random string, but the name must be distinct from other sources on the computer. 事件源通常是应用程序的名称或其他标识字符串。The event source is typically the name of the application or another identifying string. 尝试创建重复 Source 值会引发异常。Trying to create a duplicate Source value throws an exception. 不过,单个事件日志可以与多个源关联。However, a single event log can be associated with multiple sources.

如果与 EventLog 实例关联的事件日志的事件源不存在,则将创建一个新的事件源。If the event source for the event log associated with the EventLog instance doesn't exist, a new event source is created. 若要在 Windows Vista 和更高版本或 Windows Server 2003 中创建事件源,您必须具有管理凭据。To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative credentials.

此要求是因为必须搜索所有事件日志(包括安全日志),才能确定事件源是否唯一。This requirement is because all event logs, including Security logs, must be searched to determine whether the event source is unique. 从 Windows Vista 开始,用户没有访问安全日志的权限;因此,会引发 SecurityExceptionStarting with Windows Vista, users do not have permission to access the Security log; therefore, a SecurityException is thrown.

重要

创建或删除事件源需要使用已命名的 mutex 同步基础代码。Creating or deleting an event source requires synchronization of the underlying code by using a named mutex. 如果高度特权的应用程序锁定了已命名的互斥体,则尝试创建或删除事件源会导致应用程序停止响应,直到锁被释放。If a highly privileged application locks the named mutex, trying to create or delete an event source causes the application to stop responding until the lock is released. 若要帮助防止此问题,请不要向不受信任的代码授予 UnmanagedCode 权限。To help prevent this problem, never grant UnmanagedCode permission to untrusted code. 此外,UnmanagedCode 权限可能会允许绕过其他权限,只应授予高度受信任的代码。In addition, UnmanagedCode permission potentially allows other permissions to be bypassed and should only be granted to highly trusted code.

应用程序和服务应写入到应用程序日志或自定义日志。Applications and services should write to the Application log or to a custom log. 设备驱动程序应该写入系统日志。Device drivers should write to the System log. 如果未显式设置 Log 属性,则事件日志会默认为应用程序日志。If you do not explicitly set the Log property, the event log defaults to the Application log.

备注

没有任何内容可以保护应用程序不会写入任何已注册的源。There is nothing to protect an application from writing as any registered source. 如果向应用程序授予 Write 的权限,则它可以为在计算机上注册的任何有效源写入事件。If an application is granted Write permission, it can write events for any valid source registered on the computer.

使用 WriteEventWriteEntry 方法可将事件写入事件日志。Use the WriteEvent and WriteEntry methods to write events to an event log. 您必须指定事件源以写入事件;在写入包含源的第一个条目之前,必须创建并配置事件源。You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.

在应用程序安装过程中创建新的事件源。Create the new event source during the installation of your application. 这样,操作系统就可以刷新其已注册的事件源的列表及其配置。This allows time for the operating system to refresh its list of registered event sources and their configuration. 如果操作系统未刷新其事件源列表,而你尝试使用新源写入事件,则写入操作将失败。If the operating system hasn't refreshed its list of event sources, and you try to write an event with the new source, the write operation will fail. 您可以通过使用 EventLogInstaller 对象或 CreateEventSource 方法来配置新源。You can configure a new source by using an EventLogInstaller object or the CreateEventSource method. 您必须具有计算机上的管理凭据才能创建新的事件源。You must have administrative credentials on the computer to create a new event source.

每个源一次只能写入一个事件日志;但是,应用程序可以使用多个源来写入多个事件日志。Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. 例如,你的应用程序可能需要为不同的事件日志或不同的资源文件配置多个源。For example, your application might require multiple sources configured for different event logs or different resource files. 若要更改现有源的配置详细信息,必须删除该源,并使用新配置创建它。To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. 如果其他应用程序或组件使用现有源,请使用更新的配置创建新的源,而不是删除现有源。If other applications or components use the existing source, create a new source with the updated configuration instead of deleting the existing source.

可以向事件类别和消息字符串的本地化资源注册事件源。You can register the event source with localized resources for your event category and message strings. 应用程序可以通过使用资源标识符而不是指定实际的字符串值来编写事件日志项。Your application can write event log entries by using resource identifiers instead of specifying the actual string values. 有关配置源和资源文件的详细信息,请参阅 EventLogInstallerEventSourceCreationData 类。Refer to the EventLogInstaller and EventSourceCreationData classes for more information about configuring your source with resource files.

如果你的应用程序将字符串值直接写入事件日志,则无需设置源的资源文件属性。If your application writes string values directly to the event log, you do not have to set the resource file properties for the source. 源必须配置为写入本地化项或写入直接字符串。The source must be configured either for writing localized entries or for writing direct strings. 如果应用程序使用资源标识符和字符串值写入条目,则必须注册两个不同的源。If your application writes entries using both resource identifiers and string values, you must register two separate sources. 例如,将一个源配置为资源文件,然后在 WriteEvent 方法中使用该源,将使用资源标识符的项写入事件日志。For example, configure one source with resource files, and then use that source in the WriteEvent method to write entries using resource identifiers to the event log. 然后,创建一个没有资源文件的不同源,并在 WriteEntry 方法中使用该源,使用该源直接向事件日志写入字符串。Then create a different source without resource files, and use that source in the WriteEntry method to write strings directly to the event log using that source.

写入事件时,必须至少为消息字符串指定消息字符串或资源标识符。When writing events, you must at least specify either a message string or the resource identifier for a message string. 其他事件属性是可选的。Other event properties are optional. 可选事件设置的示例包括以下各项:Examples of optional event settings include the following:

  • 可以设置 EventLogEntryType,以指定事件查看器为项显示的图标。You can set the EventLogEntryType to specify the icon that the Event Viewer displays for the entry.

  • 如果你的应用程序使用类别来筛选事件,则可以为事件指定类别标识符。You can specify a category identifier for the event, if your application uses categories for filtering the events.

  • 如果要将其他信息与给定事件关联,可以将二进制数据附加到事件条目。You can attach binary data to your event entry if you want to associate additional information with a given event.

重要

事件日志记录会消耗磁盘空间、处理器时间和其他系统资源。Event logging consumes disk space, processor time, and other system resources. 只记录重要信息非常重要。It is important to log only essential information. 建议你将事件日志调用放置在错误路径中,而不是放在主代码路径中,因此它们不会对性能产生负面影响。We recommend that you place event log calls in an error path, rather than in the main code path, so they don't adversely affect performance.

有关 EventLog实例的初始属性值的列表,请参阅 EventLog 构造函数。For a list of initial property values for an instance of EventLog, see the EventLog constructor.

构造函数

EventLog()

初始化 EventLog 类的新实例。Initializes a new instance of the EventLog class. 不将该实例与任何日志关联。Does not associate the instance with any log.

EventLog(String)

初始化 EventLog 类的新实例。Initializes a new instance of the EventLog class. 将该实例与本地计算机上的日志关联。Associates the instance with a log on the local computer.

EventLog(String, String)

初始化 EventLog 类的新实例。Initializes a new instance of the EventLog class. 将该实例与指定计算机上的日志关联。Associates the instance with a log on the specified computer.

EventLog(String, String, String)

初始化 EventLog 类的新实例。Initializes a new instance of the EventLog class. 将实例与指定的计算机上的日志关联,并为 EventLog 实例创建或分配指定的源。Associates the instance with a log on the specified computer and creates or assigns the specified source to the EventLog.

属性

CanRaiseEvents

获取一个指示组件是否可以引发事件的值。Gets a value indicating whether the component can raise an event.

(继承自 Component)
Container

获取 IContainer,它包含 ComponentGets the IContainer that contains the Component.

(继承自 Component)
DesignMode

获取一个值,用以指示 Component 当前是否处于设计模式。Gets a value that indicates whether the Component is currently in design mode.

(继承自 Component)
EnableRaisingEvents

获取或设置一个值,用以指示 EventLog 是否接收 EntryWritten 事件通知。Gets or sets a value indicating whether the EventLog receives EntryWritten event notifications.

Entries

获取事件日志的内容。Gets the contents of the event log.

Events

获取附加到此 Component 的事件处理程序的列表。Gets the list of event handlers that are attached to this Component.

(继承自 Component)
Log

获取或设置读取或写入的日志名称。Gets or sets the name of the log to read from or write to.

LogDisplayName

获取事件日志的友好名称。Gets the event log's friendly name.

MachineName

获取或设置在其上读取或写入事件的计算机的名称。Gets or sets the name of the computer on which to read or write events.

MaximumKilobytes

获取或设置最大事件日志大小(以 KB 为单位)。Gets or sets the maximum event log size in kilobytes.

MinimumRetentionDays

获取要在事件日志中保留项的天数。Gets the number of days to retain entries in the event log.

OverflowAction

获取已配置的行为,以便在事件日志达到其最大文件大小时存储新项。Gets the configured behavior for storing new entries when the event log reaches its maximum log file size.

Site

获取或设置 ComponentISiteGets or sets the ISite of the Component.

(继承自 Component)
Source

获取或设置在写入事件日志时要注册和使用的源名称。Gets or sets the source name to register and use when writing to the event log.

SynchronizingObject

获取或设置用于封送事件处理程序调用的对象,该调用在有 EventLog 项写入事件时发出。Gets or sets the object used to marshal the event handler calls issued as a result of an EventLog entry written event.

方法

BeginInit()

开始初始化用于窗体或由其他组件使用的 EventLogBegins the initialization of an EventLog used on a form or used by another component. 此初始化在运行时发生。The initialization occurs at runtime.

Clear()

从事件日志中移除所有项。Removes all entries from the event log.

Close()

关闭事件日志并释放读写句柄。Closes the event log and releases read and write handles.

CreateEventSource(EventSourceCreationData)

通过使用为该事件源和对应的事件日志指定的配置属性,建立一个写入本地化事件消息的有效事件源。Establishes a valid event source for writing localized event messages, using the specified configuration properties for the event source and the corresponding event log.

CreateEventSource(String, String)

建立指定的源名称作为向本地计算机上的日志中写入日志项的有效事件源。Establishes the specified source name as a valid event source for writing entries to a log on the local computer. 此方法还可在本地计算机上创建一个新的自定义日志。This method can also create a new custom log on the local computer.

CreateEventSource(String, String, String)

建立指定的源名称作为向指定计算机上的日志中写入项的有效事件源。Establishes the specified source name as a valid event source for writing entries to a log on the specified computer. 此方法还可用于在指定计算机上创建一个新的自定义日志。This method can also be used to create a new custom log on the specified computer.

CreateObjRef(Type)

创建一个对象,该对象包含生成用于与远程对象进行通信的代理所需的全部相关信息。Creates an object that contains all the relevant information required to generate a proxy used to communicate with a remote object.

(继承自 MarshalByRefObject)
Delete(String)

从本地计算机上移除事件日志。Removes an event log from the local computer.

Delete(String, String)

从指定计算机上移除事件日志。Removes an event log from the specified computer.

DeleteEventSource(String)

从本地计算机的事件日志中移除事件源注册。Removes the event source registration from the event log of the local computer.

DeleteEventSource(String, String)

从指定的计算机上移除应用程序的事件源注册。Removes the application's event source registration from the specified computer.

Dispose()

释放由 Component 使用的所有资源。Releases all resources used by the Component.

(继承自 Component)
Dispose(Boolean)

释放由 EventLog 占用的非托管资源,还可以另外再释放托管资源。Releases the unmanaged resources used by the EventLog, and optionally releases the managed resources.

EndInit()

结束用于窗体或由其他组件使用的 EventLog 的初始化。Ends the initialization of an EventLog used on a form or by another component. 此初始化在运行时发生。The initialization occurs at runtime.

Equals(Object)

确定指定的对象是否等于当前对象。Determines whether the specified object is equal to the current object.

(继承自 Object)
Exists(String)

确定该日志是否存在于本地计算机上。Determines whether the log exists on the local computer.

Exists(String, String)

确定该日志是否存在于指定计算机上。Determines whether the log exists on the specified computer.

GetEventLogs()

在本地计算机上搜索所有的事件日志并创建一个包含该列表的 EventLog 对象数组。Searches for all event logs on the local computer and creates an array of EventLog objects that contain the list.

GetEventLogs(String)

在给定计算机上搜索所有事件日志并创建一个包含该列表的 EventLog 对象数组。Searches for all event logs on the given computer and creates an array of EventLog objects that contain the list.

GetHashCode()

用作默认哈希函数。Serves as the default hash function.

(继承自 Object)
GetLifetimeService()

检索控制此实例的生存期策略的当前生存期服务对象。Retrieves the current lifetime service object that controls the lifetime policy for this instance.

(继承自 MarshalByRefObject)
GetService(Type)

返回一个对象,该对象表示由 Component 或它的 Container 提供的服务。Returns an object that represents a service provided by the Component or by its Container.

(继承自 Component)
GetType()

获取当前实例的 TypeGets the Type of the current instance.

(继承自 Object)
InitializeLifetimeService()

获取生存期服务对象来控制此实例的生存期策略。Obtains a lifetime service object to control the lifetime policy for this instance.

(继承自 MarshalByRefObject)
LogNameFromSourceName(String, String)

获取指定的源注册到的日志的名称。Gets the name of the log to which the specified source is registered.

MemberwiseClone()

创建当前 Object 的浅表副本。Creates a shallow copy of the current Object.

(继承自 Object)
MemberwiseClone(Boolean)

创建当前 MarshalByRefObject 对象的浅表副本。Creates a shallow copy of the current MarshalByRefObject object.

(继承自 MarshalByRefObject)
ModifyOverflowPolicy(OverflowAction, Int32)

更改已配置的行为,以便在事件日志达到其最大文件大小时写入新项。Changes the configured behavior for writing new entries when the event log reaches its maximum file size.

RegisterDisplayName(String, Int64)

指定该事件日志的本地化名称,它显示在服务器事件查看器中。Specifies the localized name of the event log, which is displayed in the server Event Viewer.

SourceExists(String)

确定事件源是否已在本地计算机上注册。Determines whether an event source is registered on the local computer.

SourceExists(String, String)

确定事件源是否已在指定的计算机上注册。Determines whether an event source is registered on a specified computer.

ToString()

返回包含 Component 的名称的 String(如果有)。Returns a String containing the name of the Component, if any. 不应重写此方法。This method should not be overridden.

(继承自 Component)
WriteEntry(String)

将信息类型项与给定的消息文本一起写入事件日志。Writes an information type entry, with the given message text, to the event log.

WriteEntry(String, EventLogEntryType)

将错误、警告、信息、成功审核或失败审核项与给定的消息文本一起写入事件日志。Writes an error, warning, information, success audit, or failure audit entry with the given message text to the event log.

WriteEntry(String, EventLogEntryType, Int32)

将一个具有给定消息文本和应用程序定义的事件标识符的项写入事件日志。Writes an entry with the given message text and application-defined event identifier to the event log.

WriteEntry(String, EventLogEntryType, Int32, Int16)

将一个具有给定消息文本、应用程序定义的事件标识符和应用程序定义的类别的项写入事件日志。Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log.

WriteEntry(String, EventLogEntryType, Int32, Int16, Byte[])

将一个具有给定消息文本、应用程序定义的事件标识符和应用程序定义的类别的项写入事件日志,并向消息追加二进制数据。Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log, and appends binary data to the message.

WriteEntry(String, String)

使用指定的注册事件源将信息类型项与给定的消息文本一起写入事件日志。Writes an information type entry with the given message text to the event log, using the specified registered event source.

WriteEntry(String, String, EventLogEntryType)

使用指定的注册事件源,将错误、警告、信息、成功审核或失败审核项与给定的消息文本一起写入事件日志。Writes an error, warning, information, success audit, or failure audit entry with the given message text to the event log, using the specified registered event source.

WriteEntry(String, String, EventLogEntryType, Int32)

使用指定的注册事件源,将一个具有给定消息文本和应用程序定义的事件标识符的项写入事件日志。Writes an entry with the given message text and application-defined event identifier to the event log, using the specified registered event source.

WriteEntry(String, String, EventLogEntryType, Int32, Int16)

通过使用指定的注册事件源,将一个具有给定消息文本、应用程序定义的事件标识符和应用程序定义的类别的项写入事件日志。Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log, using the specified registered event source. 事件查看器可使用 category 筛选日志中的事件。The category can be used by the Event Viewer to filter events in the log.

WriteEntry(String, String, EventLogEntryType, Int32, Int16, Byte[])

(使用指定的注册事件源)将一个包含给定消息文本、应用程序定义的事件标识符和应用程序定义的类别的项写入事件日志,并向消息追加二进制数据。Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log (using the specified registered event source) and appends binary data to the message.

WriteEvent(EventInstance, Byte[], Object[])

写入包含给定的事件数据、消息替换字符串和关联的二进制数据的事件日志项。Writes an event log entry with the given event data, message replacement strings, and associated binary data.

WriteEvent(EventInstance, Object[])

向事件日志写入本地化项。Writes a localized entry to the event log.

WriteEvent(String, EventInstance, Byte[], Object[])

使用指定的已注册事件源,写入包含给定的事件数据、消息替换字符串和关联的二进制数据的事件日志项。Writes an event log entry with the given event data, message replacement strings, and associated binary data, and using the specified registered event source.

WriteEvent(String, EventInstance, Object[])

使用指定的已注册事件源写入包含给定事件数据和消息替换字符串的事件日志项。Writes an event log entry with the given event data and message replacement strings, using the specified registered event source.

事件

Disposed

当通过调用 Dispose() 方法释放组件时发生。Occurs when the component is disposed by a call to the Dispose() method.

(继承自 Component)
EntryWritten

向本地计算机上的事件日志写入项时发生。Occurs when an entry is written to an event log on the local computer.

适用于

另请参阅