System.Diagnostics.Eventing.Reader Namespace

使用 System.Diagnostics.Eventing.Reader 命名空間,您可以開發讀取與管理事件記錄檔的應用程式。 Using the System.Diagnostics.Eventing.Reader namespace, you can develop applications that read and manage event logs. 事件記錄檔中的事件包含特定應用程式、服務或作業系統元件已發佈的資訊、警告或錯誤。 An event in an event log contains information, a warning, or an error that has been published by a specific application, service, or operating system component. 這些事件可由監控電腦健康情況的應用程式和發生特定事件時採取行動的應用程式讀取。 These events are read by applications that monitor a computer's health and applications that take action when specific events occur. 如需詳細資訊,請參閱讀取與管理事件記錄檔的技術摘要事件記錄檔案例 For more information, see Technology Summary for Reading and Managing Event Logs and Event Log Scenarios.

類別

EventBookmark

表示事件資料流中的預留位置 (書籤)。Represents a placeholder (bookmark) within an event stream. 您可以使用預留位置 (Placeholder) 來標記位置 (Position),並返回事件資料流中的這個位置 (Position)。You can use the placeholder to mark a position and return to this position in a stream of events. 這個物件的執行個體可以從 EventRecord 物件取得,在這種情況下,它會對應至該事件記錄的位置。An instance of this object can be obtained from an EventRecord object, in which case it corresponds to the position of that event record.

EventKeyword

表示事件的關鍵字。Represents a keyword for an event. 關鍵字是在事件提供者中定義,用來將此事件與其他類似事件群組在一起 (以這些事件的用法為依據來分組)。Keywords are defined in an event provider and are used to group the event with other similar events (based on the usage of the events).

EventLevel

包含事件提供者中所定義的事件等級。Contains an event level that is defined in an event provider. 這個等級表示事件的嚴重性。The level signifies the severity of the event.

EventLogConfiguration

包含事件記錄檔的靜態資訊和組態設定。Contains static information and configuration settings for an event log. 許多組態設定都是由建立記錄檔的事件提供者所定義。Many of the configurations settings were defined by the event provider that created the log.

EventLogException

表示在讀取事件記錄檔相關資訊期間發生錯誤時,所擲回之全部例外狀況的基底類別 (Base Class)。Represents the base class for all the exceptions that are thrown when an error occurs while reading event log related information.

EventLogInformation

可讓您存取使用中事件記錄和事件記錄檔的執行階段屬性。Allows you to access the run-time properties of active event logs and event log files. 這些屬性包含記錄檔中的事件數目、記錄檔大小、判斷記錄檔是否已滿的值,以及上次寫入或存取記錄檔的時間。These properties include the number of events in the log, the size of the log, a value that determines whether the log is full, and the last time the log was written to or accessed.

EventLogInvalidDataException

表示事件提供者在事件中發行無效的資料時,所擲回的例外狀況。Represents the exception thrown when an event provider publishes invalid data in an event.

EventLogNotFoundException

表示要求的事件記錄檔 (通常以事件記錄的名稱或事件記錄檔的路徑指定) 不存在時所擲回的例外狀況。Represents the exception that is thrown when a requested event log (usually specified by the name of the event log or the path to the event log file) does not exist.

EventLogPropertySelector

包含字串陣列,這些字串表示對事件 (以事件結構描述為基準) 之 XML 表示中項目的 XPath 查詢。Contains an array of strings that represent XPath queries for elements in the XML representation of an event, which is based on the Event Schema. 這個物件中的查詢可用來擷取事件的值。The queries in this object are used to extract values from the event.

EventLogProviderDisabledException

表示指定的事件提供者名稱參考已停用的事件提供者時,所擲回的例外狀況。Represents the exception that is thrown when a specified event provider name references a disabled event provider. 已停用的事件提供者無法發行事件。A disabled event provider cannot publish events.

EventLogQuery

表示事件記錄檔中事件的查詢,以及定義如何執行查詢和執行查詢所在電腦的設定。Represents a query for events in an event log and the settings that define how the query is executed and on what computer the query is executed on.

EventLogReader

可讓您根據事件查詢來讀取事件記錄檔的事件。Enables you to read events from an event log based on an event query. 這個物件所讀取的事件會當做 EventRecord 物件傳回。The events that are read by this object are returned as EventRecord objects.

EventLogReadingException

表示在讀取、查詢或訂閱事件記錄檔相關資訊時,若發生錯誤所擲回的例外狀況。Represents an exception that is thrown when an error occurred while reading, querying, or subscribing to the events in an event log.

EventLogRecord

包含 (從 EventLogReader 物件接收的) 事件之事件執行個體的屬性。Contains the properties of an event instance for an event that is received from an EventLogReader object. 事件屬性可提供事件相關資訊,例如記錄事件所在的電腦名稱,以及事件的建立時間。The event properties provide information about the event such as the name of the computer where the event was logged and the time that the event was created.

EventLogSession

用來存取本機電腦或遠端電腦上的事件記錄服務,讓您能管理及收集電腦上事件記錄檔和事件提供者的相關資訊。Used to access the Event Log service on the local computer or a remote computer so you can manage and gather information about the event logs and event providers on the computer.

EventLogStatus

包含特定事件記錄檔的狀態碼或錯誤碼。Contains the status code or error code for a specific event log. 這個狀態可用來判斷事件記錄檔是否可用於作業。This status can be used to determine if the event log is available for an operation.

EventLogWatcher

讓您訂閱內送事件。Allows you to subscribe to incoming events. 每次所需的事件發行至事件記錄檔時,就會引發 EventRecordWritten 事件,並會執行處理這個事件的方法。Each time a desired event is published to an event log, the EventRecordWritten event is raised, and the method that handles this event will be executed.

EventMetadata

包含事件提供者中所定義事件的中繼資料 (屬性和設定)。Contains the metadata (properties and settings) for an event that is defined in an event provider.

EventOpcode

包含事件提供者中所定義的事件 opcode。Contains an event opcode that is defined in an event provider. opcode 會定義數值,這個值會識別當應用程式引發事件時,正在執行的活動或活動中的某一點。An opcode defines a numeric value that identifies the activity or a point within an activity that the application was performing when it raised the event.

EventProperty

包含發行事件時,事件提供者所指定事件屬性的值。Contains the value of an event property that is specified by the event provider when the event is published.

EventRecord

定義 (從 EventLogReader 物件接收的) 事件之事件執行個體的屬性。Defines the properties of an event instance for an event that is received from an EventLogReader object. 事件屬性可提供事件相關資訊,例如記錄事件所在的電腦名稱,以及事件的建立時間。The event properties provide information about the event such as the name of the computer where the event was logged and the time the event was created. 這個類別是抽象類別。This class is an abstract class. EventLogRecord 類別會實作這個類別。The EventLogRecord class implements this class.

EventRecordWrittenEventArgs

引發 EventRecordWritten 事件時,這個物件的執行個體會傳遞至處理該事件的委派方法。When the EventRecordWritten event is raised, an instance of this object is passed to the delegate method that handles the event. 這個物件包含已發行至事件記錄檔的事件,或包含事件訂閱失敗時所發生的例外狀況。This object contains the event that was published to the event log or the exception that occurred when the event subscription failed.

EventTask

包含事件提供者中所定義的事件工作。Contains an event task that is defined in an event provider. 工作會識別發行事件之應用程式或元件的一部分。The task identifies a portion of an application or a component that publishes an event. 工作是已保留 16 個臨界數值的 16 位元值。A task is a 16-bit value with 16 top values reserved.

ProviderMetadata

包含事件提供者的靜態資訊,例如提供者的名稱和 ID,以及提供者中定義的事件集合。Contains static information about an event provider, such as the name and id of the provider, and the collection of events defined in the provider.

列舉

EventLogIsolation

定義事件記錄檔的預設存取權限。 Application 和 System 值表示記錄檔會與適當的 Windows 記錄檔 (應用程式或系統事件記錄檔) 共用存取控制清單 (ACL),並與相同隔離的其他記錄檔共用 Windows 事件追蹤 (ETW) 工作階段。 所有具有自訂隔離的通道都會使用私用 ETW 工作階段。All channels with Custom isolation use a private ETW session.

EventLogMode

當事件記錄到達允許的大小上限 (事件記錄已滿) 時,判斷事件記錄服務處理事件記錄的行為。Determines the behavior for the event log service handles an event log when the log reaches its maximum allowed size (when the event log is full).

EventLogType

定義事件記錄檔中所記錄的事件型別。 每個記錄檔只能包含一種事件型別。Each log can only contain one type of event.

PathType

指定字串是包含事件記錄檔的名稱還是檔案系統路徑。Specifies that a string contains a name of an event log or the file system path to an event log file.

SessionAuthentication

定義遠端程序呼叫 (RPC) 登入伺服器期間所使用驗證類型的值。 當您建立指定遠端電腦連線的 EventLogSession 物件時,會發生此登入動作。This login occurs when you create a EventLogSession object that specifies a connection to a remote computer.

StandardEventKeywords

定義由事件提供者附加至事件的標準關鍵字。 如需關鍵字的詳細資訊,請參閱 EventKeywordFor more information about keywords, see EventKeyword.

StandardEventLevel

定義事件記錄服務中所使用的標準事件等級。 這個等級會定義事件的嚴重性。 除了標準等級之外,您也可以定義自訂事件等級。 如需事件等級的詳細資訊,請參閱 EventLevelFor more information about levels, see EventLevel.

StandardEventOpcode

定義由事件提供者附加至事件的標準 opcode。 如需 opcode 的詳細資訊,請參閱 EventOpcodeFor more information about opcodes, see EventOpcode.

StandardEventTask

定義由事件提供者附加至事件的標準工作。 如需工作的詳細資訊,請參閱 EventTaskFor more information about tasks, see EventTask.