EventLog.GetEventLogs EventLog.GetEventLogs EventLog.GetEventLogs EventLog.GetEventLogs Method

定義

建立事件記錄檔的陣列。Creates an array of the event logs.

多載

GetEventLogs(String) GetEventLogs(String) GetEventLogs(String) GetEventLogs(String)

搜尋指定電腦上的所有事件記錄檔,並建立含有清單的 EventLog 物件陣列。Searches for all event logs on the given computer and creates an array of EventLog objects that contain the list.

GetEventLogs() GetEventLogs() GetEventLogs() GetEventLogs()

搜尋本機電腦上的所有事件記錄檔,並建立含有清單的 EventLog 物件陣列。Searches for all event logs on the local computer and creates an array of EventLog objects that contain the list.

GetEventLogs(String) GetEventLogs(String) GetEventLogs(String) GetEventLogs(String)

搜尋指定電腦上的所有事件記錄檔,並建立含有清單的 EventLog 物件陣列。Searches for all event logs on the given computer and creates an array of EventLog objects that contain the list.

public:
 static cli::array <System::Diagnostics::EventLog ^> ^ GetEventLogs(System::String ^ machineName);
[System.MonoNotSupported("remote machine is not supported")]
public static System.Diagnostics.EventLog[] GetEventLogs (string machineName);
static member GetEventLogs : string -> System.Diagnostics.EventLog[]
Public Shared Function GetEventLogs (machineName As String) As EventLog()

參數

machineName
String String String String

要在其上搜尋事件記錄檔的電腦。The computer on which to search for event logs.

傳回

表示指定電腦上記錄檔的類型 EventLog 的陣列。An array of type EventLog that represents the logs on the given computer.

例外狀況

machineName 參數是無效的電腦名稱。The machineName parameter is an invalid computer name.

您沒有讀取登錄的權限。You do not have read access to the registry.

-或--or-

電腦上沒有事件記錄檔服務。There is no event log service on the computer.

範例

下列範例會取得電腦"位於 myServer"上的記錄檔清單。The following example gets a list of logs on the computer "myServer". 然後,它會輸出每個記錄檔的名稱。It then outputs the name of each log.

#using <System.dll>

using namespace System;
using namespace System::Diagnostics;
using namespace System::Threading;
int main()
{
   array<EventLog^>^remoteEventLogs;
   remoteEventLogs = EventLog::GetEventLogs( "myServer" );
   Console::WriteLine( "Number of logs on computer: {0}", remoteEventLogs->Length );
   System::Collections::IEnumerator^ myEnum = remoteEventLogs->GetEnumerator();
   while ( myEnum->MoveNext() )
   {
      EventLog^ log = safe_cast<EventLog^>(myEnum->Current);
      Console::WriteLine( "Log: {0}", log->Log );
   }
}

using System;
using System.Diagnostics;
using System.Threading;
              
class MySample{

    public static void Main(){
    
        EventLog[] remoteEventLogs;
    
        remoteEventLogs = EventLog.GetEventLogs("myServer");
        
        Console.WriteLine("Number of logs on computer: " + remoteEventLogs.Length);
        
        foreach(EventLog log in remoteEventLogs){
            Console.WriteLine("Log: " + log.Log);
        }                                                                      
    }       
}
   
Imports System
Imports System.Diagnostics
Imports System.Threading

Class MySample
    Public Shared Sub Main()
        Dim remoteEventLogs() As EventLog
        
        remoteEventLogs = EventLog.GetEventLogs("myServer")
        
        Console.WriteLine(("Number of logs on computer: " & remoteEventLogs.Length))
        
        Dim log As EventLog
        For Each log In  remoteEventLogs
            Console.WriteLine(("Log: " & log.Log))
        Next log
    End Sub ' Main
End Class ' MySample

備註

陣列EventLog物件是所指定的電腦上的所有事件記錄檔的快照集machineName參數時呼叫GetEventLogs為止。The array of EventLog objects is a snapshot of all event logs on the computer specified by the machineName parameter when the call to GetEventLogs is made. 這不是動態集合,因此不會反映刪除或建立即時的記錄檔。This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. 您應該確認陣列中的記錄檔存在,才能讀取或寫入其中。You should verify that a log in the array exists before you read or write to it. 陣列通常會包含至少三個記錄檔:應用程式、 系統及安全性。The array usually includes at least three logs: Application, System, and Security. 如果您指定的電腦上建立自訂記錄檔,它們會出現在陣列以及。If you created custom logs on the specified computer, they will appear in the array as well.

GetEventLogsstatic方法,所以它可呼叫EventLog類別本身。GetEventLogs is a static method, so it can be called on the EventLog class itself. 您不需要建立的執行個體EventLog撥打電話給方法的物件。It is not necessary to create an instance of an EventLog object to make a call to the method.

若要擷取的事件記錄檔清單,您必須使用適當的登錄權限。To retrieve the list of event logs, you must have the appropriate registry permissions. 這些權限完全相同的呼叫所需ExistsSourceExistsThese permissions are identical to those required to call Exists and SourceExists.

安全性

EventLogPermission
用於管理的電腦上的事件記錄檔資訊。for administering event log information on the computer. 相關聯的列舉型別: AdministerAssociated enumeration: Administer

另請參閱

GetEventLogs() GetEventLogs() GetEventLogs() GetEventLogs()

搜尋本機電腦上的所有事件記錄檔,並建立含有清單的 EventLog 物件陣列。Searches for all event logs on the local computer and creates an array of EventLog objects that contain the list.

public:
 static cli::array <System::Diagnostics::EventLog ^> ^ GetEventLogs();
public static System.Diagnostics.EventLog[] GetEventLogs ();
static member GetEventLogs : unit -> System.Diagnostics.EventLog[]
Public Shared Function GetEventLogs () As EventLog()

傳回

表示本機電腦上記錄檔的類型 EventLog 的陣列。An array of type EventLog that represents the logs on the local computer.

例外狀況

您沒有讀取登錄的權限。You do not have read access to the registry.

-或--or-

電腦上沒有事件記錄檔服務。There is no event log service on the computer.

範例

下列範例會列舉在本機電腦上定義的事件記錄檔,並顯示每個事件記錄檔的組態詳細資料。The following example enumerates the event logs defined on the local computer, and displays configuration details for each event log.

void DisplayEventLogProperties()
{
   
   // Iterate through the current set of event log files,
   // displaying the property settings for each file.
   array<EventLog^>^eventLogs = EventLog::GetEventLogs();
   System::Collections::IEnumerator^ myEnum = eventLogs->GetEnumerator();
   while ( myEnum->MoveNext() )
   {
      EventLog^ e = safe_cast<EventLog^>(myEnum->Current);
      Int64 sizeKB = 0;
      Console::WriteLine();
      Console::WriteLine( "{0}:", e->LogDisplayName );
      Console::WriteLine( "  Log name = \t\t {0}", e->Log );
      Console::WriteLine( "  Number of event log entries = {0}", e->Entries->Count );
      
      // Determine if there is a file for this event log.
      RegistryKey ^ regEventLog = Registry::LocalMachine->OpenSubKey( String::Format( "System\\CurrentControlSet\\Services\\EventLog\\{0}", e->Log ) );
      if ( regEventLog )
      {
         Object^ temp = regEventLog->GetValue( "File" );
         if ( temp != nullptr )
         {
            Console::WriteLine( "  Log file path = \t {0}", temp );
            FileInfo^ file = gcnew FileInfo( temp->ToString() );
            
            // Get the current size of the event log file.
            if ( file->Exists )
            {
               sizeKB = file->Length / 1024;
               if ( (file->Length % 1024) != 0 )
               {
                  sizeKB++;
               }
               Console::WriteLine( "  Current size = \t {0} kilobytes", sizeKB );
            }
         }
         else
         {
            Console::WriteLine( "  Log file path = \t <not set>" );
         }
      }
      
      // Display the maximum size and overflow settings.
      sizeKB = e->MaximumKilobytes;
      Console::WriteLine( "  Maximum size = \t {0} kilobytes", sizeKB );
      Console::WriteLine( "  Overflow setting = \t {0}", e->OverflowAction );
      switch ( e->OverflowAction )
      {
         case OverflowAction::OverwriteOlder:
            Console::WriteLine( "\t Entries are retained a minimum of {0} days.", e->MinimumRetentionDays );
            break;

         case OverflowAction::DoNotOverwrite:
            Console::WriteLine( "\t Older entries are not overwritten." );
            break;

         case OverflowAction::OverwriteAsNeeded:
            Console::WriteLine( "\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry." );
            break;

         default:
            break;
      }
   }
}


static void DisplayEventLogProperties()
{
    // Iterate through the current set of event log files,
    // displaying the property settings for each file.

    EventLog[] eventLogs = EventLog.GetEventLogs();
    foreach (EventLog e in eventLogs)
    {
        Int64 sizeKB = 0;

        Console.WriteLine();
        Console.WriteLine("{0}:", e.LogDisplayName);
        Console.WriteLine("  Log name = \t\t {0}", e.Log); 

        Console.WriteLine("  Number of event log entries = {0}", e.Entries.Count.ToString());
                    
        // Determine if there is an event log file for this event log.
        RegistryKey regEventLog = Registry.LocalMachine.OpenSubKey("System\\CurrentControlSet\\Services\\EventLog\\" + e.Log);
        if (regEventLog != null)
        {
            Object temp = regEventLog.GetValue("File");
            if (temp != null)
            {
                Console.WriteLine("  Log file path = \t {0}", temp.ToString());
                FileInfo file = new FileInfo(temp.ToString());

                // Get the current size of the event log file.
                if (file.Exists)
                {
                    sizeKB = file.Length / 1024;
                    if ((file.Length % 1024) != 0)
                    {
                        sizeKB++;
                    }
                    Console.WriteLine("  Current size = \t {0} kilobytes", sizeKB.ToString());
                }
            }
            else
            {
                Console.WriteLine("  Log file path = \t <not set>");
            }
        }
                    
        // Display the maximum size and overflow settings.

        sizeKB = e.MaximumKilobytes;
        Console.WriteLine("  Maximum size = \t {0} kilobytes", sizeKB.ToString());
        Console.WriteLine("  Overflow setting = \t {0}", e.OverflowAction.ToString());

        switch (e.OverflowAction)
        {
            case OverflowAction.OverwriteOlder:
                Console.WriteLine("\t Entries are retained a minimum of {0} days.", 
                    e.MinimumRetentionDays);
                break;
            case OverflowAction.DoNotOverwrite:
                Console.WriteLine("\t Older entries are not overwritten.");
                break;
            case OverflowAction.OverwriteAsNeeded:
                Console.WriteLine("\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry.");
                break;
            default:
                break;
        }
    }
}
Shared Sub DisplayEventLogProperties()

   ' Iterate through the current set of event log files,
   ' displaying the property settings for each file.
   Dim eventLogs As EventLog() = EventLog.GetEventLogs()
   
   Dim e As EventLog
   For Each e In  eventLogs
      Dim sizeKB As Int64 = 0
      
      Console.WriteLine()
      Console.WriteLine("{0}:", e.LogDisplayName)
      Console.WriteLine("  Log name = " + ControlChars.Tab _
                          + ControlChars.Tab + " {0}", e.Log)

      Console.WriteLine("  Number of event log entries = {0}", e.Entries.Count.ToString())
      
      ' Determine if there is an event log file for this event log.
      Dim regEventLog As RegistryKey
      regEventLog = Registry.LocalMachine.OpenSubKey( _
             ("System\CurrentControlSet\Services\EventLog\" + e.Log))

      If Not (regEventLog Is Nothing) Then

         Dim temp As Object = regEventLog.GetValue("File")
         If Not (temp Is Nothing) Then

            Console.WriteLine("  Log file path = " + ControlChars.Tab _
                                  + " {0}", temp.ToString())
            Dim file As New FileInfo(temp.ToString())
            
            ' Get the current size of the event log file.
            If file.Exists Then
               sizeKB = file.Length / 1024
               If file.Length Mod 1024 <> 0 Then
                  sizeKB += 1
               End If
               Console.WriteLine("  Current size = " + ControlChars.Tab _
                          + " {0} kilobytes", sizeKB.ToString())
            End If
         Else
            Console.WriteLine("  Log file path = " + ControlChars.Tab _
                             + " <not set>")
         End If
      End If
      
      ' Display the maximum size and overflow settings.
      sizeKB = e.MaximumKilobytes
      Console.WriteLine("  Maximum size = " + ControlChars.Tab _
                         + " {0} kilobytes", sizeKB.ToString())
      Console.WriteLine("  Overflow setting = " + ControlChars.Tab _
                         + " {0}", e.OverflowAction.ToString())
      
      Select Case e.OverflowAction
         Case OverflowAction.OverwriteOlder
            Console.WriteLine(ControlChars.Tab + _
                 " Entries are retained a minimum of {0} days.", _
                 e.MinimumRetentionDays)
         Case OverflowAction.DoNotOverwrite
            Console.WriteLine(ControlChars.Tab + _
                 " Older entries are not overwritten.")
         Case OverflowAction.OverwriteAsNeeded
            Console.WriteLine(ControlChars.Tab + _
                 " If number of entries equals max size limit, a new event log entry overwrites the oldest entry.")
         Case Else
      End Select

   Next e

End Sub

備註

陣列EventLog物件是在本機電腦上的所有事件記錄檔的快照集時呼叫GetEventLogs為止。The array of EventLog objects is a snapshot of all event logs on the local computer when the call to GetEventLogs is made. 這不是動態集合,因此不會反映刪除或建立即時的記錄檔。This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. 您應該確認陣列中的記錄檔存在,才能讀取或寫入其中。You should verify that a log in the array exists before you read or write to it. 陣列通常會包含至少三個記錄檔:應用程式、 系統及安全性。The array usually includes at least three logs: Application, System, and Security. 如果您在本機電腦上建立自訂記錄檔,它們會出現在陣列以及。If you created custom logs on the local computer, they will appear in the array as well.

若要擷取的事件記錄檔清單,您必須使用適當的登錄權限。To retrieve the list of event logs, you must have the appropriate registry permissions. 這些權限完全相同的呼叫所需ExistsSourceExistsThese permissions are identical to those required to call Exists and SourceExists.

安全性

EventLogPermission
用於管理的電腦上的事件記錄檔資訊。for administering event log information on the computer. 相關聯的列舉型別: AdministerAssociated enumeration: Administer

另請參閱

適用於