How to get UserData in Event log?

Question

I need to search event log, here is the code I have:

    IEnumerable<EventLogEntry> q = (
    from entry in el.Entries.Cast<EventLogEntry>()
    where entry.Source == sourceName

    orderby entry.TimeGenerated descending
    select entry
)

In the event log, it has UserData, which includes some data I need:

In the EventLogEntry, I can get some of the data, i.e. Message, but not all of them, i.e. Subject, HealthSet, ..

So the question is: how can I get the XML of the event log entry? Assume I can access the UserData from there.

Thanks

Answer 1

You could try:

        EventLogQuery query = new EventLogQuery("Setup", PathType.LogName);
        EventLogReader reader = new EventLogReader(query);
        EventRecord record;

        while ((record = reader.ReadEvent()) != null)
            Debug.WriteLine(record.ToXml());

Sample output string containing <UserData>:

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Servicing' Guid='{BD12F3B8-FC40-4A61-A307-B7A013A069C1}'/><EventID>4</EventID><Version>0</Version><Level>0</Level><Task>1</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2015-10-15T14:01:06.098062300Z'/><EventRecordID>109</EventRecordID><Correlation/><Execution ProcessID='10060' ThreadID='4452'/><Channel>Setup</Channel><Computer>WINWIZ</Computer><Security UserID='S-1-5-18'/></System><UserData><CbsPackageChangeState xmlns='http://manifests.microsoft.com/win/2004/08/windows/setup_provider'><PackageIdentifier>KB3097617</PackageIdentifier><IntendedPackageState>Installed</IntendedPackageState><ErrorCode>0x0</ErrorCode><Client>WindowsUpdateAgent</Client></CbsPackageChangeState></UserData></Event>