Can I list all registered event sources?

问题:

My windows service writes to the event log, but I've had various problems getting this correct. So in the process I used a number of different names. I followed an article describing how to set up event logs in windows services. So after adding an EventLog component in the designer, I have added this to the constructor:

if (!System.Diagnostics.EventLog.SourceExists("AS0604"))
   System.Diagnostics.EventLog.CreateEventSource("AS0604", "SIRR");

eventLog1.Source = "AS0604";
eventLog1.Log = "SIRR";
eventLog1.WriteEntry("AS is initializing...", EventLogEntryType.Information, 16);

I found out that there is trouble if the source has the same name as the service name of the windows service. But I kept changing the names a lot for both the Log and the Source. The

EventLog[] eventLogs = EventLog.GetEventLogs();

Lists the eventlogs and I was able to remove those I didn't use with EventLog.Delete command.

But how does this work? Are there still registered sources in these deleted logs? Can I get a list of registered sources?

回答1:

From a good bit of playing around with it, it looks like the answer is you cannot get a list of sources from this API. Deleting the log deletes the sources that where registered with it.

This page tells you how to do this using direct registry access:

http://codeidol.com/csharp/csharpckbk2/Diagnostics/Finding-All-Sources-Belonging-to-a-Specific-Event-Log/

回答2:

Since the accepted answer is lost, here is another. Unfortunately I found no alternative to examining the Windows Registry directly.

• PowerShell (Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\<EventLogPathName>).pschildname

E.g. to list the Windows Application Event Log's Sources:

• PowerShell (Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application).pschildname

I threw this up after reading several sources. Unfortunately none were very clear or direct.

回答3:

via powershell:

Get-EventLog -LogName Application |Select-Object Source -Unique 

see: https://social.technet.microsoft.com/Forums/windowsserver/en-US/48d1e34d-6ded-4039-a8a4-3b17d9c69488/list-eventlog-sources?forum=winserverpowershell