Limit EventLogs by Date

Question

I am grabbing eventlogs then displaying them in a datagrid, however for large logs it takes forever to return, so I would like to limit the logs by last 24hours but I am not sure how to do that. I would like to limit the collection prior to iterating through each entry because that would still take as long done that way. Any help would be totally appreciated!!!

namespace SysTools
{
    public partial class LogViewer : Form
    {
        DataTable eventLog = new DataTable();
        DataSet dataset1 = new DataSet();
        private EventLog unhandledLogs;
        public LogViewer(EventLog logs)
        {
            unhandledLogs = logs;
            InitializeComponent();
        }

        private void LogViewer_Load(object sender, EventArgs e)
        {
            String currentLog = unhandledLogs.Log;
            DataTable dataTable1 = new DataTable();
            DataColumn column;
            column = new DataColumn();
            column.DataType = System.Type.GetType("System.String");
            column.ColumnName = "Level";
            dataTable1.Columns.Add(column);
            column = new DataColumn();
            column.DataType = System.Type.GetType("System.String");
            column.ColumnName = "Category";
            dataTable1.Columns.Add(column);
            column = new DataColumn();
            column.DataType = System.Type.GetType("System.DateTime");
            column.ColumnName = "DateTime";
            dataTable1.Columns.Add(column);
            column = new DataColumn();
            column.DataType = System.Type.GetType("System.String");
            column.ColumnName = "Message";
            dataTable1.Columns.Add(column);
            dataTable1.Rows.Clear();
            DateTime systemtime = new DateTime();
           Int32 count = unhandledLogs.Entries.Count;
            for (int currLogIndex = 0; currLogIndex <= unhandledLogs.Entries.Count; currLogIndex++)
            {
                DataRow drnew = dataTable1.NewRow();
                try
                {
                    EventLogEntry currLogEntrys = unhandledLogs.Entries[currLogIndex];
                    EventLogEntry currLogEntry = currLogEntrys;
                    string entrytype = currLogEntrys.EntryType.ToString();
                    drnew["Level"] = entrytype;
                    drnew["Category"] = currLogEntry.Source;
                    drnew["DateTime"] = currLogEntry.TimeGenerated;
                    drnew["Message"] = currLogEntry.Message;
                    dataTable1.Rows.Add(drnew);
                }
                catch { }
            }
            dataGridView1.DataSource = dataTable1;
            dataTable1.DefaultView.Sort = ("DateTime asc");
        }
    }
}

Answer 1

Have a look at the EventLogQuery and EventLogReader classes. In my example below, I'm reading the past 24 hours worth of logs from the Application Event Log, and putting them into a list. You can easily adapt to suit you own log and needs.

Note I'm doing something moderately hacky to get the date into the expected format (you should improve that), but see how I'm creating a query and then only processing the retrieved records.

    public void GetEvents()
    {
        string FormattedDateTime = string.Format("{0}-{1}-{2}T{3}:{4}:{5}.000000000Z",
            DateTime.Now.Year,
            DateTime.Now.Month.ToString("D2"),
            DateTime.Now.AddDays(-1).Day.ToString("D2"),
            DateTime.Now.Hour.ToString("D2"),
            DateTime.Now.Minute.ToString("D2"),
            DateTime.Now.Second.ToString("D2"));

        string LogSource = @"Application";
        string Query = "*[System[TimeCreated[@SystemTime >= '" + FormattedDateTime + "']]]";

        var QueryResult = new EventLogQuery(LogSource, PathType.LogName, Query);
        var Reader = new System.Diagnostics.Eventing.Reader.EventLogReader(QueryResult);

        List<EventRecord> Events = new List<EventRecord>();

        bool Reading = true;

        while (Reading)
        {
            EventRecord Rec = Reader.ReadEvent();

            if (Rec == null)
                Reading = false;

            Events.Add(Rec);
            // You could add to your own collection here instead of adding to a list

        }
    }