[DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Auto)]
static extern bool BackupEventLog(IntPtr hEventLog, string backupFile);
Declare Function BackupEventLog Lib "advapi32.dll" (TODO) As TODO
None.
EventLogSession from the namespace System.Diagnostics.Eventing.Reader can be used in most cases
To save the 'Applilcation' event log:
EventLogSession eventLogSession = new EventLogSession();
eventLogSession.ExportLogAndMessages("Application", PathType.LogName, "*", @"logFile.evtx", false, CultureInfo.CurrentCulture);
None.
Please add some!
Save the application log to disk:
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
static extern bool BackupEventLog(IntPtr hEventLog, string backupFile);
[DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
static extern IntPtr OpenEventLog(string lpUNCServerName, string lpSourceName);
[DllImport("advapi32.dll", SetLastError = true)]
public static extern bool CloseEventLog(IntPtr hEventLog);
SaveLog()
{
IntPtr logHandle = OpenEventLog(null, "Application");
BackupEventLog(logHandle, @"c:\logfile.evtx");
CloseEventLog(logHandle);
}