EventLog.Log 屬性


取得或設定要讀取或寫入的事件記錄檔的名稱。Gets or sets the name of the log to read from or write to.

 property System::String ^ Log { System::String ^ get(); void set(System::String ^ value); };
public string Log { get; set; }
[System.ComponentModel.TypeConverter("System.Diagnostics.Design.LogConverter, System.Design, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")]
public string Log { get; set; }
[System.ComponentModel.TypeConverter("System.Diagnostics.Design.LogConverter, System.Design, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")]
public string Log { get; set; }
[System.ComponentModel.TypeConverter("System.Diagnostics.Design.LogConverter, System.Design, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")]
public string Log { get; set; }
[System.ComponentModel.TypeConverter("System.Diagnostics.Design.LogConverter, System.Design, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")]
public string Log { get; set; }
member this.Log : string with get, set
Public Property Log As String


記錄檔的名稱。The name of the log. 可以是應用程式、系統、安全性或者自訂的記錄檔名稱。This can be Application, System, Security, or a custom log name. 預設為空字串 ("")。The default is an empty string ("").



下列範例會讀取本機電腦上事件記錄檔 "NewEventLog" 中的專案。The following example reads entries in the event log, "NewEventLog", on the local computer.

#using <System.dll>

using namespace System;
using namespace System::Diagnostics;
int main()
   EventLog^ myNewLog = gcnew EventLog;
   myNewLog->Log = "NewEventLog";
   System::Collections::IEnumerator^ myEnum = myNewLog->Entries->GetEnumerator();
   while ( myEnum->MoveNext() )
      EventLogEntry^ entry = safe_cast<EventLogEntry^>(myEnum->Current);
      Console::WriteLine( "\tEntry: {0}", entry->Message );

using System;
using System.Diagnostics;
class MySample{

    public static void Main(){

        EventLog myNewLog = new EventLog();
        myNewLog.Log = "NewEventLog";                      
        foreach(EventLogEntry entry in myNewLog.Entries){
            Console.WriteLine("\tEntry: " + entry.Message);
Imports System.Diagnostics

Class MySample
    Public Shared Sub Main()
        Dim myNewLog As New EventLog()
        myNewLog.Log = "NewEventLog"
        Dim entry As EventLogEntry
        For Each entry In  myNewLog.Entries
            Console.WriteLine((ControlChars.Tab & "Entry: " & entry.Message))
        Next entry
    End Sub
End Class


伺服器上預設會有三個記錄檔:應用程式、系統和安全性。Three log files exist by default on the server: Application, System, and Security. 應用程式和服務會使用應用程式記錄檔。Applications and services use the Application log file. 設備磁碟機會使用系統記錄檔。Device drivers use the System log file. 當開啟 [啟用] 時,系統會在安全性記錄檔中產生成功和失敗的 audit 事件。The system generates success and failure audit events in the Security log when auditing is turned on. 如果您已安裝其他應用程式(例如 Windows 伺服器上的 Active Directory),可能會有其他的預設記錄檔。If you have other applications installed, like Active Directory on Windows servers, there might be other default log files. 此外,您可以在本機或遠端電腦上建立自訂記錄檔。In addition, you can create custom log files on a local or remote computer. 當您的元件將事件寫入預設應用程式記錄檔時,自訂記錄有助於以更詳細的方式來組織您的專案。Custom logs help organize your entries in a more detailed way than is allowed when your components write events to the default Application log.


記錄檔名稱限制為八個字元。Log names are limited to eight characters. 根據系統,MyLogSample1 和 MyLogSample2 是相同的記錄檔。According to the system, MyLogSample1 and MyLogSample2 are the same log.

如果您寫入事件記錄檔,則指定 Log 屬性並不夠。If you write to an event log, it is not enough to specify the Log property. 您必須將 Source 屬性與事件記錄檔資源建立關聯,才能將它連接到特定的記錄檔。You must associate a Source property with your event log resource to connect it to a particular log. 當唯讀取記錄檔時,不需要指定 Source,但事件來源必須與伺服器登錄中的事件記錄檔資源相關聯。It is not necessary to specify a Source when only reading from a log, but an event source must be associated with the event log resource in the server's registry. 您只能指定要從中讀取的 Log 名稱和 MachineName (伺服器電腦名稱稱)。You can specify only the Log name and MachineName (server computer name) to read from it.


如果您要連接到記錄檔,則不需要指定 MachineNameYou are not required to specify the MachineName if you are connecting to a log. 如果您未指定 MachineName,則會假設為本機電腦(".")。If you do not specify the MachineName, the local computer (".") is assumed.

如果尚未指定 Source 屬性,如果尚未明確設定 Log (藉由設定 Log 屬性,或透過函式),則呼叫 Log 會傳回空字串。If the Source property has not been specified, a call to Log returns an empty string if Log has not been explicitly set (by setting the Log property, or through the constructor). 如果已指定 SourceLog 會傳回已註冊該來源的記錄檔名稱。If the Source has been specified, Log returns the name of the log to which that source was registered.

來源一次只能註冊至一個記錄檔。A source can only be registered to one log at a time. 如果 Source 屬性是針對 EventLog的實例所設定,您就無法變更該 EventLogLog 屬性,而不需要變更 Source 或先呼叫 DeleteEventSource 的值。If the Source property was set for an instance of EventLog, you cannot change the Log property for that EventLog without changing the value of Source or calling DeleteEventSource first. 如果您在設定 Source 屬性之後變更 Log 屬性,寫入記錄專案就會擲回例外狀況。If you change the Log property after the Source property has been set, writing a log entry throws an exception.

作業系統會將事件記錄檔儲存為檔案。The operating system stores event logs as files. 當您使用 EventLogInstallerCreateEventSource 建立新的事件記錄檔時,相關聯的檔案會儲存在指定電腦上的%SystemRoot%\System32\Config 目錄中。When you use EventLogInstaller or CreateEventSource to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. 檔案名是藉由附加 Log 屬性的前8個字元加上 ".evt" 副檔名來設定。The file name is set by appending the first 8 characters of the Log property with the ".evt" file name extension.

您無法單獨使用 Log 屬性來建立新的記錄檔(不指定記錄檔的來源)。You cannot create a new log using the Log property alone (without specifying a source for the log). 您可以呼叫 CreateEventSource,傳入新的記錄檔名稱做為參數,然後呼叫 DeleteEventSourceYou can call CreateEventSource, passing in a new log name as a parameter, and then call DeleteEventSource. 不過,此目的通常是用來建立(並將專案寫入)新的應用程式特定記錄檔,或從現有的記錄檔讀取。However, the intent is usually either to create (and write entries to) new application-specific logs, or to read from existing logs.

如果 Log 值變更,則會關閉事件記錄檔,並釋放所有事件控制碼。If the Log value changes, the event log is closed and all event handles are released.


如果您將 [Log] 屬性設定為不存在之記錄檔的名稱,系統會將 EventLog 附加至應用程式記錄檔,但不會警告您它使用的是您所指定的記錄檔。If you set the Log property to the name of a log that does not exist, the system attaches the EventLog to the Application log, but does not warn you that it is using a log other than the one you specified.