在C＃中使用WMI读取事件查看器内容时，如何获取与文化无关的类型信息

Question

I am reading logs from EventViewer using below lines of code.

var searcher = new ManagementObjectSearcher(@"\\WS2012-DE01\root\cimv2",
               "SELECT * FROM Win32_NTLogEvent WHERE  Type ='Error'");

above code works fine in en-US culture, but will fail in other culture because other culture will be representing Error as some other word.

eg: Error word in de-DE culture(german) represents as Fehler . I will be using the same code in different environement. I do not want to maintain a resource file since issue is with only one word or not need a Translator API because of security measures to solve this. Could anyone please provide me a solution.

Answer 1

Don't query filtering by the name of the event type, but filtering by the internal type id:

var searcher = new ManagementObjectSearcher(@"\\WS2012-DE01\root\cimv2",
               "SELECT * FROM Win32_NTLogEvent WHERE EventType=1");

You can see the list of possible values for EventType in the documentation of the WMI Win32_NTLogEvent class .

Note that the property Type is a string and contains the type in the local language, while EventType is an integer with a fixed meaning like

• 1 = Error
• 2 = Warning
• 3 = Information
• 4 = Security Audit Success
• 5 = Security Audit Failure