How to get all properties of event viewer file(.evtx)?

Sumit Kumawat

Hi All

I am writing a Text file which is containing all properties of .Evtx file.

While retiring the properties of event viewer file (.evtx) sometimes some properties values are coming as a null. for example below properties:

LevelDisplayName

TaskDisplayName

EventID

I am getting null values for them sometimes.

So I want to ask is there any other properties which have same values so that I can read values.

Thanks

What I have tried:

I tried to search all properties while debugging but not able to find.

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Sumit Kumawat9y ago
hi manas
my path is correct and even im able to fetching all values from properties.
it is just in case sometime some properties values are returning null value.
Manas Mohapatra9y ago
To resolve your issue:

1. Make sure the path is correct(evtx)
2. EventID can't be null. Just loop over the file and see if same EventID is present in EventLog. It may be some junk data present in the file.

https://stackoverflow.com/questions/30809133/read-event-log-file-from-path

https://phejndorf.wordpress.com/2011/03/31/using-c-and-linq-to-read-a-windows-eventlog-file-evtx/

http://www.aspheute.com/english/20000811.asp