C# Manage windows events

Question

I would like to delete an event from the Windows event log using C#.

Can anyone point me in the right direction of how to achieve this?

Answer 1

Easy :).
But the removing is look like removing item from array , you need to make a copy of all array, except of item that you need to remove.
There is example, how to "remove each of item from log where item have non even index".

using System;
using System.Collections;
using System.Diagnostics;
using System.Threading;

class EventLogEntryCollection_Item
{
    /// <summary>
    /// Prints all.
    /// </summary>
    /// <param name="myEventLogEntryCollection">My event log entry collection.</param>
    private static void PrintAll(EventLogEntryCollection myEventLogEntryCollection)
    {
        for (int i = 0; i < myEventLogEntryCollection.Count; i++)
        {
            Console.WriteLine("The Message of the EventLog is :"
               + myEventLogEntryCollection[i].Message);
        }
    }

    /// <summary>
    /// Creates the new log message.
    /// </summary>
    /// <param name="LogName">Name of the log.</param>
    /// <param name="message">The message.</param>
    private static void CreateNewLogMessage(string LogName, string message)
    {
        EventLog myEventLog = new EventLog();
        myEventLog.Source = LogName;
        myEventLog.WriteEntry(message);
        myEventLog.Close();
    }

    /// <summary>
    /// Mains this instance.
    /// </summary>
    public static void Main()
    {
        try
        {

            // Check if the source exists.
            if (!EventLog.SourceExists("MySource"))
            {
                // Create the source.
                // An event log source should not be created and immediately used.
                // There is a latency time to enable the source, it should be created
                // prior to executing the application that uses the source.
                EventLog.CreateEventSource("MySource", "MySource");
                Console.WriteLine("Creating EventSource");
                Console.WriteLine("Exiting, execute the application a second time to use the source.");
                Thread.Sleep(2000);
                // The source is created.  sleep to allow it to be registered.
            }

            string myLogName = EventLog.LogNameFromSourceName("MySource", ".");

            // Create a new EventLog object.
            EventLog myEventLog1 = new EventLog();
            myEventLog1.Log = myLogName;

            //Create test messages.
            myEventLog1.Clear();
            for (int i = 0; i < 20; i++)
            {
                CreateNewLogMessage("MySource", "The entry number is " + i);
            }

            // Obtain the Log Entries of "MyNewLog".
            EventLogEntryCollection myEventLogEntryCollection =
               myEventLog1.Entries;
            //myEventLog1.Close();
            Console.WriteLine("The number of entries in 'MyNewLog' = "
               + myEventLogEntryCollection.Count);

            // Copy the EventLog entries to Array of type EventLogEntry.
            EventLogEntry[] myEventLogEntryArray =
               new EventLogEntry[myEventLogEntryCollection.Count];
            myEventLogEntryCollection.CopyTo(myEventLogEntryArray, 0);

            Console.WriteLine("before deleting");
            // Display the 'Message' property of EventLogEntry.
            PrintAll(myEventLogEntryCollection);

            myEventLog1.Clear();

            Console.WriteLine("process deleting");
            foreach (EventLogEntry myEventLogEntry in myEventLogEntryArray)
            {
                //Console.WriteLine("The LocalTime the Event is generated is "
                // + myEventLogEntry.TimeGenerated + " ; " + myEventLogEntry.Message);
                if (myEventLogEntry.Index % 2 == 0)
                {
                    CreateNewLogMessage("MySource", myEventLogEntry.Message);
                }
            }

            Console.WriteLine("after deleting");
            PrintAll(myEventLogEntryCollection);

            myEventLog1.Close();
        }
        catch (Exception e)
        {
            Console.WriteLine("Exception:{0}", e.Message);
        }
        Console.ReadKey();
    }
}

Answer 2

I don't believe you can delete one specific event from the eventlog. It's all or nothing. If you want to get rid of one, you have to clear the whole log.

Edit: The only thing you can do is Clear the log . Well, okay, you can delete the entire log from the computer, if it's not Security, Application, or System, but you definitely can't remove one entry.

Answer 3

I don't think it's possible. Take a look at the System.Diagnostics namespace and tis EventLog* classes for additional documentation.