Reading the Forwarded Events from the Event Viewer

Question

I want the parse throw the Forwarded Events in the Event Viewer to get an overview about the last 12 hours. This is not a problem when using the application or system log. But when I try the same with the Forwarded Events log it throws an error.

Error Message:

System.InvalidOperationException: The event log 'ForwardedEvents' on computer '.' does not exist

The way I get the Logs at the moment:

EventLog systemLog = new EventLog("System");
EventLog forwardedLog = new EventLog("ForwardedEvents");

So I tried changing the ForwardedEvents to "system\forwardedevents", "Forwarded Events" but this also did not work.

I noticed that if I' using the following the the Forwarded Events don't show up.

EventLog.GetEventLogs()

Is there any other way to read the Event Viewer?

Answer 1

Please use EventLogReader

Try with the following:

        static void Main(string[] args)
        {
            EventLogQuery eventsQuery = new EventLogQuery("ForwardedEvents", PathType.LogName);

            try
            {
                EventLogReader logReader = new EventLogReader(eventsQuery);

                for (EventRecord eventdetail = logReader.ReadEvent(); eventdetail != null; eventdetail = logReader.ReadEvent())
                {
                    Console.WriteLine(eventdetail.FormatDescription());
                }
            }
            catch (EventLogNotFoundException e)
            {
                Console.WriteLine("Error while reading the event logs");
            }

            Console.ReadKey();
        }

I don't have any forwarded event but it does not fail.