Use EventLogReader in Desc order mode?

Question

Im using in

  EventLogQuery eventsQuery = new EventLogQuery("Security", PathType.LogName, queryString);
  EventLogReader logReader = new EventLogReader(eventsQuery);

In order to read the log events.

I need to find the latest usage of event number #xxx ( nevermind)

But the reader begins from 1--->100

I need it to start from 100--->1 so I can get the first one (which satisfies my query) and Break the loop.

I don't want to use middleman DATA BUFFER and then reverse it.

p.s. - my log file is about 400 mb. ( win7).

Mating

Answer 1

You could use the ReverseDirection property on the EventLogQuery class:

EventLogQuery eventsQuery = new EventLogQuery("Security", PathType.LogName, queryString);
eventsQuery.ReverseDirection = true;

EventLogReader logReader = new EventLogReader(eventsQuery);

Hope, this helps.

Chitchat

Is it the fastest way to read the last event from event log using c# – Mating

@Royi Namir: Is it the fastest way? It depends on the kind of application you are programming. If your application is running all the time then you could subscribe for certain events to occur instead of repeatly querying the event log. – Chitchat

Answer 2

just FYI, if you just want the last XX events from the Event Viewer, you don't have to use EventLogReader. I prefer not to use ELR because it is limited to Vista/Windows2008/Win7. To do this using the oldschool EventLog object in .NET, you can just use the indexer on the "Entries" object. Example in the following snippet:

        EventLog log = new EventLog("Application");
        for (int counter = 1; counter <= sizeToGet; counter++)
        {
            string msg = log.Entries[log.Entries.Count - counter].Message;

            Console.WriteLine(msg)
        }

Subalternate