如何使用System.Diagnostics.EventLog从任意evxt文件读取？

Question

How can I use EventLog to read from an arbitrary evtx file?

EventLogQuery is able to open evtx files, but it is not available in .NET 2.0.

Answer 1

Let's assume the log file is LogA.evtx .

Copy LogA.evtx to C:\\Windows\\System32\\winevt\\Logs .

Add a new registry key to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog

called LogA . Eg in PowerShell:

Set-Location HKLM:

New-Item .\SYSTEM\CurrentControlSet\services\eventlog -Name LogA

Open Event Viewer to verify that LogA shows up under Applications and Services Logs .

You can now open LogA using EventLog :

using System;
using System.Diagnostics;

namespace EventLogTest
{
    class Program
    {
        static void Main(string[] args)
        {
            var log = new EventLog("LogA");

            Console.WriteLine(log.Entries.Count);
        }
    }
}

You can delete LogA via PowerShell:

[System.Diagnostics.EventLog]::Delete("LogA")