C# 取得作業系統事件日誌 (2) - 完整程式碼範例：EventLogEntryCollection 讀取與命令列參數支援

完整程式碼 (LogView 專案)

using System.Diagnostics;
using System;

namespace LogView
{
    public class SysLogView
    {
        private EventLogEntryCollection eventCollection;
        private EventLog systemEvent;

        public SysLogView()
        {
            systemEvent = new EventLog { Log = "System" };
            eventCollection = systemEvent.Entries;
        }

        private void LoadEventLog(int index)
        {
            EventLog log = new EventLog { Log = "System" };
            eventCollection = log.Entries;
            int len = eventCollection.Count;
            EventLogEntry entry = eventCollection[index];

            string[] title = {
                entry.EntryType.ToString(),
                entry.TimeGenerated.ToLongDateString(),
                entry.TimeGenerated.ToLongTimeString(),
                entry.Source,
                entry.Category,
                entry.EventID.ToString(),
                entry.UserName,
                entry.MachineName
            };
            foreach (string t in title) Console.WriteLine(t);
            Console.WriteLine("\n" + entry.Message);
        }

        private string DisplayEventCount() => eventCollection.Count.ToString();

        public static void Main(string[] args)
        {
            SysLogView slv = new SysLogView();
            if (args.Length == 1)
            {
                int x = Convert.ToInt32(args[0]);
                slv.LoadEventLog(x);
            }
            else
            {
                Console.WriteLine("Event count: " + slv.DisplayEventCount());
                Console.WriteLine("Usage: SysLogView.exe ");
            }
        }
    }
}

關鍵類別

• EventLog：Log 屬性指定 "System"/"Application"/"Security"。
• EventLogEntryCollection：日誌項目集合，索引器存取單筆。
• EventLogEntry：單筆屬性 (EntryType、TimeGenerated、Source、Message 等)。

執行方式

編譯為 SysLogView.exe，命令列帶索引參數查看特定項目，無參數顯示總筆數與用法。