We are trying to do some in-house print auditing for printers we have running on a Windows Server 2008 R2. After enabling the log via Event Viewer in:
Applications and Services Logs -> Microsoft -> Windows -> PrintService -> Operational
I'm successfully grabbing events with the ID 307 by tailoring the answer to this question to my needs and then storing those events in a database for use in other applications.
// Build formatted query string
string eventID = "307";
string logSource = "Microsoft-Windows-PrintService/Operational";
string sQuery = String.Format("*[System/EventID={0}]", eventID);
// Define query and reader
var elQuery = new EventLogQuery(logSource, PathType.LogName, sQuery);
var elReader = new System.Diagnostics.Eventing.Reader.EventLogReader(elQuery);
// List for holding events
List<EventRecord> eventList = new List<EventRecord>();
for (EventRecord eventInstance = elReader.ReadEvent();
null != eventInstance; eventInstance = elReader.ReadEvent())
{
eventList.Add(eventInstance);
}
What I am unable to do now is clear that log after saving those events.
It allows me to manually clear this log from the Event Viewer, but running:
public static void PrintLogs()
{
foreach (var eventLog in EventLog.GetEventLogs())
{
Console.WriteLine(eventLog.Log.ToString());
}
}
only outputs the higher level logs listed under "Applications and Services Logs":
Application
HardwareEvents
Internet Explorer
Key Management Service
OAlerts // Not sure where OAlerts and
PreEmptive // PreEmptive are in the Event Viewer
Security
System
Windows PowerShell
The answer to this question hints that you can't use the EventLog class to access Microsoft-Windows-* event logs.
Is there anything I can do to programmatically clear this specific event log (not just 307 events, but the other ones in the Operational log as well)?
I'd like to set this little program up to run every few minutes, hours, or days automatically, but right now it would be a lot of checking the database for existing events and just adding the few that are new since the last time it ran.