Programmatically create a custom Eventlog view

Question

I want to programmatically create a custom Eventlog view in a C# application.

This is how to create a custom Eventlog view with the help of the Eventlog application from Microsoft Windows:

I searched the class System.Diagnostics.EventLog for a method that does the same as the button found in the Eventlog Application from Microsoft. Sadly, i couldn't find any functionality that covers my needs.

Has anyone ever programmatically created a custom Eventlog view in C# or knows a way that works?

Marris

What exactly DOES this button do? (maybe even a screenshot of what it does would be good to see there to help – Strep

@Strep Sadly I can't add an image to my post since my reputation is to low. Here's an image of this button – Marris

Answer 1

If just tested the approach found here:

try
{
    XmlTextWriter view = new XmlTextWriter("C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\View_1.xml", Encoding.Unicode);
    // Root.
    view.WriteStartDocument();
    view.WriteStartElement("ViewerConfig");
    //Create Node for queryConfig
    view.WriteStartElement("QueryConfig");
    view.WriteStartElement("QueryParams");
    view.WriteStartElement("UserQuery");
    view.WriteEndElement();
    view.WriteEndElement();
    //QueryNode
    view.WriteStartElement("QueryNode");
    //....

    view.Close();
}
catch (XmlException ex)
{
    Console.WriteLine(ex.StackTrace);
}

This created a custom view for me.

Basically, custom views are xml files stored under C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ and you can just roll you own, by creating an xml document.

If you want to know how to format such an xml document, you can always fall back to the already pre defined querys in the Server Roles folder under C:\ProgramData\Microsoft\Event Viewer\Views\ServerRoles

Concessive

Thanks, this worked great. However, now that I know that there's the folder with the .xml files, I'll probably just create the .xml beforehand and just move it to the folder programmatically. – Marris

I would do it that way too. It could come in handy when issuing out requested VMs and run configuration scripts to create those views. – Concessive

Answer 2

Possible solution is:

1. Create a desired custom view using eventvwr.msc interface (shown on image provided by you).
2. Export it to a .xml file and study/make little research about it's structure
3. Write a code to generate such .xml file based on your needs or use already crafted and exported only replacing appropriate "placeholders" (event codes, event sources, etc.)
4. Run eventvwr.exe with /v option like eventvwr.exe /v:MyView.xml (more options using eventvwr.exe /?)

Kibitka

This is basically the same approach that Serv used, which worked. Thanks. – Marris