Search code examples
c#event-log

C# - Format event log query with multiple arguments


I have the following event log query where I need to filter by event ID and specific date range for the Time Created. Here is what I current have:

var _PRINTINGDOCUMENTEVENTID = "307";
var startTime = System.DateTime.Now.AddMinutes(-10);
var endTime = System.DateTime.Now

var query = string.Format("*[[System/EventID={0}] and [System[TimeCreated[@SystemTime >= {1}]]] and [System[TimeCreated[@SystemTime <= {2}]]]", _PRINTINGDOCUMENTEVENTID, startTime.ToUniversalTime().ToString("o"), endTime.ToUniversalTime().ToString("o"));)

var logQuery = new EventLogQuery("Microsoft-Windows-PrintService/Operational", PathType.LogName, query );

var reader = new EventLogReader(logQuery);

I get the following error when I try to debug the event log query:

The specified query is invalid

Here is what the query value looks like while debugging:

"*[[System/EventID=307] and [System[TimeCreated[@SystemTime >= 2016-03-28T22:51:23.9082575Z]]] and [System[TimeCreated[@SystemTime <= 2016-03-28T23:01:23.9092576Z]]]"

How do I fix this issue?


Solution

  • I was able to determine the correct format for filtering by event id and a date range for TimeCreated

    var eventId = "307";
    var startTime = System.DateTime.Now.AddMinutes(-10);
    var endTime = System.DateTime.Now;
    
    var query = string.Format(@"*[System/EventID={0}] and *[System[TimeCreated[@SystemTime >= '{1}']]] and *[System[TimeCreated[@SystemTime <= '{2}']]]",
        eventId, 
        startTime.ToUniversalTime().ToString("o"),
        endTime.ToUniversalTime().ToString("o"));