public EventRecord ReadEvent(TimeSpan timeout)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
if (this.isEof)
{
throw new InvalidOperationException();
}
if (this.currentIndex >= this.eventCount)
{
// buffer is empty, get next batch.
GetNextBatch(timeout);
if (this.currentIndex >= this.eventCount)
{
this.isEof = true;
return(null);
}
}
EventLogRecord eventInstance = new EventLogRecord(new EventLogHandle(this.eventsBuffer[currentIndex], true), this.eventQuery.Session, this.cachedMetadataInformation);
currentIndex++;
return(eventInstance);
}
public EventLogPropertySelector(IEnumerable <string> propertyQueries)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
if (propertyQueries == null)
{
throw new ArgumentNullException("propertyQueries");
}
string[] paths;
ICollection <string> coll = propertyQueries as ICollection <string>;
if (coll != null)
{
paths = new string[coll.Count];
coll.CopyTo(paths, 0);
}
else
{
List <string> queries;
queries = new List <string>(propertyQueries);
paths = queries.ToArray();
}
renderContextHandleValues = NativeWrapper.EvtCreateRenderContext(paths.Length, paths, UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextValues);
}
private void RequestEvents()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
this.asyncException = null;
bool flag = false;
do
{
if (!this.isSubscribing)
{
return;
}
try
{
if (!NativeWrapper.EvtNext(this.handle, this.eventsBuffer.Length, this.eventsBuffer, 0, 0, ref this.numEventsInBuffer))
{
break;
}
}
catch (EventLogException exception)
{
this.asyncException = exception;
}
this.HandleEventsRequestCompletion();
}while (flag);
}
public EventLogSession(string server, string domain, string user, SecureString password, SessionAuthentication logOnType)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
if (server == null)
{
server = "localhost";
}
syncObject = new object();
this.server = server;
this.domain = domain;
this.user = user;
this.logOnType = logOnType;
UnsafeNativeMethods.EvtRpcLogin erLogin = new UnsafeNativeMethods.EvtRpcLogin();
erLogin.Server = this.server;
erLogin.User = this.user;
erLogin.Domain = this.domain;
erLogin.Flags = (int)this.logOnType;
erLogin.Password = CoTaskMemUnicodeSafeHandle.Zero;
try {
if (password != null)
{
erLogin.Password.SetMemory(Marshal.SecureStringToCoTaskMemUnicode(password));
}
//open a session using the erLogin structure.
handle = NativeWrapper.EvtOpenSession(UnsafeNativeMethods.EvtLoginClass.EvtRpcLogin, ref erLogin, 0, 0);
}
finally {
erLogin.Password.Close();
}
}
protected virtual void Dispose(bool disposing)
{
if (disposing)
{
if (this == globalSession)
{
throw new InvalidOperationException();
}
EventLogPermissionHolder.GetEventLogPermission().Demand();
}
if (this.renderContextHandleSystem != null &&
!this.renderContextHandleSystem.IsInvalid)
{
this.renderContextHandleSystem.Dispose();
}
if (this.renderContextHandleUser != null &&
!this.renderContextHandleUser.IsInvalid)
{
this.renderContextHandleUser.Dispose();
}
if (handle != null && !handle.IsInvalid)
{
handle.Dispose();
}
}
private void RequestEvents()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
this.asyncException = null;
Debug.Assert(this.numEventsInBuffer == 0);
bool results = false;
do
{
if (!this.isSubscribing)
{
break;
}
try
{
results = NativeWrapper.EvtNext(this.handle, this.eventsBuffer.Length, this.eventsBuffer, 0, 0, ref this.numEventsInBuffer);
if (!results)
{
return;
}
}
catch (Exception e)
{
this.asyncException = new EventLogException();
this.asyncException.Data.Add("RealException", e);
}
HandleEventsRequestCompletion();
} while (results);
}
public EventLogSession(string server, string domain, string user, SecureString password, SessionAuthentication logOnType)
{
this.renderContextHandleSystem = EventLogHandle.Zero;
this.renderContextHandleUser = EventLogHandle.Zero;
this.handle = EventLogHandle.Zero;
EventLogPermissionHolder.GetEventLogPermission().Demand();
if (server == null)
{
server = "localhost";
}
this.syncObject = new object();
this.server = server;
this.domain = domain;
this.user = user;
this.logOnType = logOnType;
Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin login = new Microsoft.Win32.UnsafeNativeMethods.EvtRpcLogin {
Server = this.server,
User = this.user,
Domain = this.domain,
Flags = (int)this.logOnType,
Password = CoTaskMemUnicodeSafeHandle.Zero
};
try
{
if (password != null)
{
login.Password.SetMemory(Marshal.SecureStringToCoTaskMemUnicode(password));
}
this.handle = NativeWrapper.EvtOpenSession(Microsoft.Win32.UnsafeNativeMethods.EvtLoginClass.EvtRpcLogin, ref login, 0, 0);
}
finally
{
login.Password.Close();
}
}
public override string ToXml()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
StringBuilder buffer = new StringBuilder(0x7d0);
NativeWrapper.EvtRender(EventLogHandle.Zero, this.handle, Microsoft.Win32.UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventXml, buffer);
return(buffer.ToString());
}
public override string ToXml()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
StringBuilder renderBuffer = new StringBuilder(2000);
NativeWrapper.EvtRender(EventLogHandle.Zero, this.handle, UnsafeNativeMethods.EvtRenderFlags.EvtRenderEventXml, renderBuffer);
return(renderBuffer.ToString());
}
public EventLogSession()
{
this.renderContextHandleSystem = EventLogHandle.Zero;
this.renderContextHandleUser = EventLogHandle.Zero;
this.handle = EventLogHandle.Zero;
EventLogPermissionHolder.GetEventLogPermission().Demand();
this.syncObject = new object();
}
internal void StartSubscribing()
{
if (this.isSubscribing)
{
throw new InvalidOperationException();
}
int flag = 0;
if (bookmark != null)
{
flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeStartAfterBookmark;
}
else if (this.readExistingEvents)
{
flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeStartAtOldestRecord;
}
else
{
flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeToFutureEvents;
}
if (this.eventQuery.TolerateQueryErrors)
{
flag |= (int)UnsafeNativeMethods.EvtSubscribeFlags.EvtSubscribeTolerateQueryErrors;
}
EventLogPermissionHolder.GetEventLogPermission().Demand();
this.callbackThreadId = -1;
this.unregisterDoneHandle = new AutoResetEvent(false);
this.subscriptionWaitHandle = new AutoResetEvent(false);
EventLogHandle bookmarkHandle = EventLogRecord.GetBookmarkHandleFromBookmark(bookmark);
using (bookmarkHandle)
{
handle = NativeWrapper.EvtSubscribe(this.eventQuery.Session.Handle,
this.subscriptionWaitHandle.SafeWaitHandle,
this.eventQuery.Path,
this.eventQuery.Query,
bookmarkHandle,
IntPtr.Zero,
IntPtr.Zero,
flag);
}
this.isSubscribing = true;
RequestEvents();
this.registeredWaitHandle = ThreadPool.RegisterWaitForSingleObject(
this.subscriptionWaitHandle,
new WaitOrTimerCallback(SubscribedEventsAvailableCallback),
null,
-1,
false);
}
internal void StopSubscribing()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
//
// need to set isSubscribing to false before waiting for completion of callback.
//
this.isSubscribing = false;
if (this.registeredWaitHandle != null)
{
this.registeredWaitHandle.Unregister(this.unregisterDoneHandle);
if (this.callbackThreadId != Thread.CurrentThread.ManagedThreadId)
{
//
// not calling Stop from within callback - wait for
// any outstanding callbacks to complete.
//
if (this.unregisterDoneHandle != null)
{
this.unregisterDoneHandle.WaitOne();
}
}
this.registeredWaitHandle = null;
}
if (this.unregisterDoneHandle != null)
{
this.unregisterDoneHandle.Close();
this.unregisterDoneHandle = null;
}
if (this.subscriptionWaitHandle != null)
{
this.subscriptionWaitHandle.Close();
this.subscriptionWaitHandle = null;
}
for (int i = 0; i < this.numEventsInBuffer; i++)
{
if (eventsBuffer[i] != IntPtr.Zero)
{
NativeWrapper.EvtClose(eventsBuffer[i]);
eventsBuffer[i] = IntPtr.Zero;
}
}
this.numEventsInBuffer = 0;
if (handle != null && !handle.IsInvalid)
{
handle.Dispose();
}
}
protected virtual void Dispose(bool disposing)
{
if (disposing)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
}
if (renderContextHandleValues != null && !renderContextHandleValues.IsInvalid)
{
renderContextHandleValues.Dispose();
}
}
protected virtual void Dispose(bool disposing)
{
if (disposing)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
}
if (handle != null && !handle.IsInvalid)
{
handle.Dispose();
}
}
internal void SetupUserContext()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
lock (this.syncObject)
{
if (this.renderContextHandleUser.IsInvalid)
{
this.renderContextHandleUser = NativeWrapper.EvtCreateRenderContext(0, null, Microsoft.Win32.UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextUser);
}
}
}
public EventLogConfiguration(string logName, EventLogSession session)
{
this.handle = EventLogHandle.Zero;
EventLogPermissionHolder.GetEventLogPermission().Demand();
if (session == null)
{
session = EventLogSession.GlobalSession;
}
this.session = session;
this.channelName = logName;
this.handle = NativeWrapper.EvtOpenChannelConfig(this.session.Handle, this.channelName, 0);
}
public void Seek(EventBookmark bookmark, long offset)
{
if (bookmark == null)
{
throw new ArgumentNullException("bookmark");
}
EventLogPermissionHolder.GetEventLogPermission().Demand();
this.SeekReset();
using (EventLogHandle handle = EventLogRecord.GetBookmarkHandleFromBookmark(bookmark))
{
NativeWrapper.EvtSeek(this.handle, offset, handle, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToBookmark);
}
}
protected virtual void Dispose(bool disposing)
{
if (disposing)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
}
while (this.currentIndex < this.eventCount)
{
NativeWrapper.EvtClose(this.eventsBuffer[this.currentIndex]);
this.currentIndex++;
}
if ((this.handle != null) && !this.handle.IsInvalid)
{
this.handle.Dispose();
}
}
protected override void Dispose(bool disposing)
{
try {
if (disposing)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
}
if (this.handle != null && !this.handle.IsInvalid)
{
this.handle.Dispose();
}
}
finally {
base.Dispose(disposing);
}
}
internal EventLogInformation(EventLogSession session, string channelName, PathType pathType)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
EventLogHandle logHandle = NativeWrapper.EvtOpenLog(session.Handle, channelName, pathType);
using (logHandle) {
creationTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogCreationTime);
lastAccessTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastAccessTime);
lastWriteTime = (DateTime?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastWriteTime);
fileSize = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogFileSize));
fileAttributes = (int?)((uint?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogAttributes));
recordCount = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogNumberOfLogRecords));
oldestRecordNumber = (long?)((ulong?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogOldestRecordNumber));
isLogFull = (bool?)NativeWrapper.EvtGetLogInfo(logHandle, UnsafeNativeMethods.EvtLogPropertyId.EvtLogFull);
}
}
internal void SetupSystemContext()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
if (!this.renderContextHandleSystem.IsInvalid)
{
return;
}
lock (this.syncObject) {
if (this.renderContextHandleSystem.IsInvalid)
{
//create the SYSTEM render context
//call the EvtCreateRenderContext to get the renderContextHandleSystem, so that we can get the system/values/user properties.
this.renderContextHandleSystem = NativeWrapper.EvtCreateRenderContext(0, null, UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextSystem);
}
}
}
public EventLogReader(EventLogQuery eventQuery, EventBookmark bookmark)
{
if (eventQuery == null)
{
throw new ArgumentNullException("eventQuery");
}
string logfile = null;
if (eventQuery.ThePathType == PathType.FilePath)
{
logfile = eventQuery.Path;
}
this.cachedMetadataInformation = new ProviderMetadataCachedInformation(eventQuery.Session, logfile, 50);
this.eventQuery = eventQuery;
this.batchSize = 0x40;
this.eventsBuffer = new IntPtr[this.batchSize];
int flags = 0;
if (this.eventQuery.ThePathType == PathType.LogName)
{
flags |= 1;
}
else
{
flags |= 2;
}
if (this.eventQuery.ReverseDirection)
{
flags |= 0x200;
}
if (this.eventQuery.TolerateQueryErrors)
{
flags |= 0x1000;
}
EventLogPermissionHolder.GetEventLogPermission().Demand();
this.handle = NativeWrapper.EvtQuery(this.eventQuery.Session.Handle, this.eventQuery.Path, this.eventQuery.Query, flags);
EventLogHandle bookmarkHandleFromBookmark = EventLogRecord.GetBookmarkHandleFromBookmark(bookmark);
if (!bookmarkHandleFromBookmark.IsInvalid)
{
using (bookmarkHandleFromBookmark)
{
NativeWrapper.EvtSeek(this.handle, 1L, bookmarkHandleFromBookmark, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToBookmark);
}
}
}
public IEnumerable <string> GetProviderNames()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
List <string> list = new List <string>(100);
using (EventLogHandle handle = NativeWrapper.EvtOpenProviderEnum(this.Handle, 0))
{
bool finish = false;
do
{
string item = NativeWrapper.EvtNextPublisherId(handle, ref finish);
if (!finish)
{
list.Add(item);
}
}while (!finish);
return(list);
}
}
internal ProviderMetadata(string providerName, EventLogSession session, CultureInfo targetCultureInfo, string logFilePath)
{
this.handle = EventLogHandle.Zero;
this.defaultProviderHandle = EventLogHandle.Zero;
EventLogPermissionHolder.GetEventLogPermission().Demand();
if (targetCultureInfo == null)
{
targetCultureInfo = CultureInfo.CurrentCulture;
}
if (session == null)
{
session = EventLogSession.GlobalSession;
}
this.session = session;
this.providerName = providerName;
this.cultureInfo = targetCultureInfo;
this.logFilePath = logFilePath;
this.handle = NativeWrapper.EvtOpenProviderMetadata(this.session.Handle, this.providerName, this.logFilePath, this.cultureInfo.LCID, 0);
this.syncObject = new object();
}
public void Seek(SeekOrigin origin, long offset)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
switch (origin)
{
case SeekOrigin.Begin:
this.SeekReset();
NativeWrapper.EvtSeek(this.handle, offset, EventLogHandle.Zero, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToFirst);
return;
case SeekOrigin.Current:
if (offset < 0L)
{
if ((this.currentIndex + offset) >= 0L)
{
this.SeekCommon(offset);
}
else
{
this.SeekCommon(offset);
}
return;
}
if ((this.currentIndex + offset) >= this.eventCount)
{
this.SeekCommon(offset);
return;
}
for (int i = this.currentIndex; i < (this.currentIndex + offset); i++)
{
NativeWrapper.EvtClose(this.eventsBuffer[i]);
}
this.currentIndex += (int)offset;
return;
case SeekOrigin.End:
this.SeekReset();
NativeWrapper.EvtSeek(this.handle, offset, EventLogHandle.Zero, 0, Microsoft.Win32.UnsafeNativeMethods.EvtSeekFlags.EvtSeekRelativeToLast);
return;
}
}
internal EventLogInformation(EventLogSession session, string channelName, PathType pathType)
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
EventLogHandle handle = NativeWrapper.EvtOpenLog(session.Handle, channelName, pathType);
using (handle)
{
this.creationTime = (DateTime?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogCreationTime);
this.lastAccessTime = (DateTime?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastAccessTime);
this.lastWriteTime = (DateTime?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogLastWriteTime);
long?nullable = (long?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogFileSize);
this.fileSize = nullable.HasValue ? new long?(nullable.GetValueOrDefault()) : null;
int?nullable3 = (int?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogAttributes);
this.fileAttributes = nullable3.HasValue ? new int?(nullable3.GetValueOrDefault()) : null;
long?nullable5 = (long?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogNumberOfLogRecords);
this.recordCount = nullable5.HasValue ? new long?(nullable5.GetValueOrDefault()) : null;
long?nullable7 = (long?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogOldestRecordNumber);
this.oldestRecordNumber = nullable7.HasValue ? new long?(nullable7.GetValueOrDefault()) : null;
this.isLogFull = (bool?)NativeWrapper.EvtGetLogInfo(handle, Microsoft.Win32.UnsafeNativeMethods.EvtLogPropertyId.EvtLogFull);
}
}
public EventLogPropertySelector(IEnumerable <string> propertyQueries)
{
string[] strArray;
EventLogPermissionHolder.GetEventLogPermission().Demand();
if (propertyQueries == null)
{
throw new ArgumentNullException("propertyQueries");
}
ICollection <string> is2 = propertyQueries as ICollection <string>;
if (is2 != null)
{
strArray = new string[is2.Count];
is2.CopyTo(strArray, 0);
}
else
{
strArray = new List <string>(propertyQueries).ToArray();
}
this.renderContextHandleValues = NativeWrapper.EvtCreateRenderContext(strArray.Length, strArray, Microsoft.Win32.UnsafeNativeMethods.EvtRenderContextFlags.EvtRenderContextValues);
}
public IEnumerable <string> GetLogNames()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
List <string> namesList = new List <string>(100);
using (EventLogHandle channelEnum = NativeWrapper.EvtOpenChannelEnum(this.Handle, 0))
{
bool finish = false;
do
{
string s = NativeWrapper.EvtNextChannelPath(channelEnum, ref finish);
if (finish == false)
{
namesList.Add(s);
}
}while (finish == false);
return(namesList);
}
}
internal void StartSubscribing()
{
if (this.isSubscribing)
{
throw new InvalidOperationException();
}
int flags = 0;
if (this.bookmark != null)
{
flags |= 3;
}
else if (this.readExistingEvents)
{
flags |= 2;
}
else
{
flags |= 1;
}
if (this.eventQuery.TolerateQueryErrors)
{
flags |= 0x1000;
}
EventLogPermissionHolder.GetEventLogPermission().Demand();
this.callbackThreadId = -1;
this.unregisterDoneHandle = new AutoResetEvent(false);
this.subscriptionWaitHandle = new AutoResetEvent(false);
EventLogHandle bookmarkHandleFromBookmark = EventLogRecord.GetBookmarkHandleFromBookmark(this.bookmark);
using (bookmarkHandleFromBookmark)
{
this.handle = NativeWrapper.EvtSubscribe(this.eventQuery.Session.Handle, this.subscriptionWaitHandle.SafeWaitHandle, this.eventQuery.Path, this.eventQuery.Query, bookmarkHandleFromBookmark, IntPtr.Zero, IntPtr.Zero, flags);
}
this.isSubscribing = true;
this.RequestEvents();
this.registeredWaitHandle = ThreadPool.RegisterWaitForSingleObject(this.subscriptionWaitHandle, new WaitOrTimerCallback(this.SubscribedEventsAvailableCallback), null, -1, false);
}
internal void StopSubscribing()
{
EventLogPermissionHolder.GetEventLogPermission().Demand();
this.isSubscribing = false;
if (this.registeredWaitHandle != null)
{
this.registeredWaitHandle.Unregister(this.unregisterDoneHandle);
if ((this.callbackThreadId != Thread.CurrentThread.ManagedThreadId) && (this.unregisterDoneHandle != null))
{
this.unregisterDoneHandle.WaitOne();
}
this.registeredWaitHandle = null;
}
if (this.unregisterDoneHandle != null)
{
this.unregisterDoneHandle.Close();
this.unregisterDoneHandle = null;
}
if (this.subscriptionWaitHandle != null)
{
this.subscriptionWaitHandle.Close();
this.subscriptionWaitHandle = null;
}
for (int i = 0; i < this.numEventsInBuffer; i++)
{
if (this.eventsBuffer[i] != IntPtr.Zero)
{
NativeWrapper.EvtClose(this.eventsBuffer[i]);
this.eventsBuffer[i] = IntPtr.Zero;
}
}
this.numEventsInBuffer = 0;
if ((this.handle != null) && !this.handle.IsInvalid)
{
this.handle.Dispose();
}
}
