/// <summary> /// Gets basic event information. /// </summary> /// <param name="log">The event's log.</param> /// <param name="source">The event's source. Can be <c>null</c>.</param> /// <param name="eventId">The event's id. Can be <c>null</c>.</param> /// <returns><c>true</c> if subscription represents a basic event, <c>false</c> if not.</returns> public bool GetBasic(out string log, out string source, out int? eventId) { log = source = null; eventId = null; if (!string.IsNullOrEmpty(this.Subscription)) { using (System.IO.MemoryStream str = new System.IO.MemoryStream(System.Text.Encoding.UTF8.GetBytes(this.Subscription))) { using (System.Xml.XmlTextReader rdr = new System.Xml.XmlTextReader(str)) { rdr.MoveToContent(); rdr.ReadStartElement("QueryList"); if (rdr.Name == "Query" && rdr.MoveToAttribute("Path")) { string path = rdr.Value; if (rdr.MoveToElement() && rdr.ReadToDescendant("Select") && path.Equals(rdr["Path"], StringComparison.InvariantCultureIgnoreCase)) { string content = rdr.ReadString(); System.Text.RegularExpressions.Match m = System.Text.RegularExpressions.Regex.Match(content, @"\*(?:\[System\[(?:Provider\[\@Name='(?<s>[^']+)'\])?(?:\s+and\s+)?(?:EventID=(?<e>\d+))?\]\])", System.Text.RegularExpressions.RegexOptions.IgnoreCase | System.Text.RegularExpressions.RegexOptions.Compiled | System.Text.RegularExpressions.RegexOptions.Singleline | System.Text.RegularExpressions.RegexOptions.IgnorePatternWhitespace); if (m.Success) { log = path; if (m.Groups["s"].Success) source = m.Groups["s"].Value; if (m.Groups["e"].Success) eventId = Convert.ToInt32(m.Groups["e"].Value); return true; } } } } } } return false; }