Question

I am having a small problem trying to get the Event ID when I use WMI to monitor the event log. Here is my code:

private static void EventLogMonitor(object sender, EventArrivedEventArgs e)
{
    int realEventId = (int)(e.NewEvent.Properties["EventID"].Value);
    ...

But it fails to pick up the Event ID for me, just throwing an exception. Does anybody know what should go in place of “EventID” in the line of code above so that I can access the Event ID of the event log entry written event that fires this handler?

Answer 1

I found out how to do this, for anybody else that finds this useful here is the code:

private static void EventLogMonitor(object sender, EventArrivedEventArgs e)
{
    ManagementBaseObject targetInstance = (ManagementBaseObject)e.NewEvent
                                                  .GetPropertyValue("TargetInstance");
    UInt16 EventId = (UInt16)(targetInstance.GetPropertyValue("EventCode"));