Hi i'm trying to make a c# console application that will monitor copychimp.exe if it sets an error on event logs on current date
Here's what i have try
static void Main(string[] args)
{
string eventlofName = "Application";
EventLog logs = new EventLog();
logs.Log = eventlofName;
foreach(EventLogEntry log in logs.Entries){
Console.WriteLine("{0}\n" + log.Message);
}
}
this is my step and don't know whats next.
I have no control on Copychimp.exe.
Here's the error on event logs i want to capture
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name=".NET Runtime" />
<EventID Qualifiers="0">1026</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2019-10-18T05:26:38.001427000Z" />
<EventRecordID>17564</EventRecordID>
<Channel>Application</Channel>
<Computer>PHCAB01DT0160.NWS.NEXPERIA.COM</Computer>
<Security />
</System>
- <EventData>
<Data>Application: CopyChimpServer.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.IndexOutOfRangeException at CopyChimpServer.Program.Main(System.String[])</Data>
</EventData>
</Event>
Out put if copychimp.exe has an error on event logs in event viewer check if it is equals to date now it should print "An error Occured an CopyChimp.exe "
the reason for this app is to monitor if copychimp.exe has crashed in order to re run it, it is running on server so there should be a other app that will monitor copychimp
Hope you understand what i mean
Sorry for my bad english
Related
I have a C# project which is an exe file (console app) and some dlls and one dll ist written in C++. On Winodws 10 it runs fine and on a Win 7 too. But on a Win 7 and Win2008 Server on a Virtual Maschine I get an unhandled exception. In the main function I have already added
AppDomain.CurrentDomain.UnhandledException += new UnhandledExceptionEventHandler(CurrentDomain_UnhandledException);
But unfortunately the exception must be thrown before the main function is called. How can I catch this exception?
I have installed .net 4.6.1 and I compared the installed packages between Win 10 and Win 7 on real PCs with the installed packages on the virutal maschines and I fine no different.
Thats what I can see in the event log:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-08-14T10:03:41.000000000Z" />
<EventRecordID>5060</EventRecordID>
<Channel>Application</Channel>
<Computer>PC-dummy</Computer>
<Security />
</System>
<EventData>
<Data>MyApp.exe</Data>
<Data>1.6.1.1</Data>
<Data>5f365f53</Data>
<Data>KERNELBASE.dll</Data>
<Data>6.1.7601.24511</Data>
<Data>5d3fa9ff</Data>
<Data>e0434352</Data>
<Data>000000000000b87d</Data>
<Data>658</Data>
<Data>01d67222300b6618</Data>
<Data>D:\MyProject\MyApp.exe</Data>
<Data>C:\Windows\system32\KERNELBASE.dll</Data>
<Data>6dbcb3b9-de15-11ea-b17f-000c29a2a32b</Data>
</EventData>
</Event>
and
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name=".NET Runtime" />
<EventID Qualifiers="0">1026</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2020-08-14T10:03:41.000000000Z" />
<EventRecordID>5059</EventRecordID>
<Channel>Application</Channel>
<Computer>PC-dummy</Computer>
<Security />
</System>
<EventData>
<Data>Application: MyApp.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.IO.FileNotFoundException at MyConsole.Program.Main(System.String[])</Data>
</EventData>
</Event>
Recently I updated my Windows 10 with the Anniversary update. Since then Visual Studio crashes like crazy and some of the programs are not working.
Here are the crash errors:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name=".NET Runtime" />
<EventID Qualifiers="0">1026</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-08-18T18:16:39.081375400Z" />
<EventRecordID>2999</EventRecordID>
<Channel>Application</Channel>
<Computer>PC</Computer>
<Security />
</System>
- <EventData>
<Data>Application: devenv.exe Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.TypeLoadException at
Microsoft.VisualStudio.VIL.DebuggerHost.VirtualAppDomain.get_DebuggerTypeUniverse() at
Microsoft.VisualStudio.VIL.DebuggerHost.GlobalContext.Dispose(Boolean) at
Microsoft.VisualStudio.VIL.VisualStudioHost.VSGlobalContext.Dispose(Boolean) at
Microsoft.VisualStudio.VIL.VisualStudioHost.Interpreter.Destroy() at
VSDebugEngine.ClrInspector.VilHelper.Dispose() at
VSDebugEngine.ClrInspector.VilHelper.OnClose() at
Microsoft.VisualStudio.Debugger.DkmDataItem.InvokeOnClose(XapiComponentInfo*, Microsoft.VisualStudio.Debugger.DkmDataItem) at
Microsoft.VisualStudio.Debugger.DkmDataContainer.OnCloseNativeObject(XapiComponentInfo**) at
Microsoft.VisualStudio.Debugger.DkmDataContainer.Callback_OnCloseNativeObject(IntPtr, XapiComponentInfo**)</Data>
</EventData>
</Event>
And
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-08-18T18:16:39.250653400Z" />
<EventRecordID>3000</EventRecordID>
<Channel>Application</Channel>
<Computer>PC</Computer>
<Security />
</System>
- <EventData>
<Data>devenv.exe</Data>
<Data>14.0.25420.1</Data>
<Data>57685d85</Data>
<Data>KERNELBASE.dll</Data>
<Data>10.0.14393.0</Data>
<Data>57898e34</Data>
<Data>e0434352</Data>
<Data>000d96c2</Data>
<Data>1e38</Data>
<Data>01d1f97c98f42dde</Data>
<Data>C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\devenv.exe</Data>
<Data>C:\WINDOWS\System32\KERNELBASE.dll</Data>
<Data>f9cb238c-e79f-46c2-bd5e-1ddcaa9fb9c7</Data>
<Data />
<Data />
</EventData>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-08-18T19:10:34.635049600Z" />
<EventRecordID>3122</EventRecordID>
<Channel>Application</Channel>
<Computer>PC</Computer>
<Security />
</System>
- <EventData>
<Data>Microsoft.Alm.Shared.Remoting.RemoteContainer.dll</Data>
<Data>14.0.23107.0</Data>
<Data>559b78f2</Data>
<Data>KERNELBASE.dll</Data>
<Data>10.0.14393.0</Data>
<Data>57898e34</Data>
<Data>e0434352</Data>
<Data>000d96c2</Data>
<Data>19cc</Data>
<Data>01d1f9843068d6aa</Data>
<Data>C:\WINDOWS\Microsoft.Net\assembly\GAC_32\Microsoft.Alm.Shared.Remoting.RemoteContainer\v4.0_14.0.0.0__b03f5f7f11d50a3a\Microsoft.Alm.Shared.Remoting.RemoteContainer.dll</Data>
<Data>C:\WINDOWS\System32\KERNELBASE.dll</Data>
<Data>7d4ce7e2-ade2-4814-bb3e-84dfebb60b4e</Data>
<Data />
<Data />
</EventData>
</Event>
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name=".NET Runtime" />
<EventID Qualifiers="0">1026</EventID>
<Level>2</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2016-08-18T19:10:34.561501300Z" />
<EventRecordID>3121</EventRecordID>
<Channel>Application</Channel>
<Computer>PC</Computer>
<Security />
</System>
- <EventData>
<Data>Application: Microsoft.Alm.Shared.Remoting.RemoteContainer.dll Framework Version: v4.0.30319 Description: The process was terminated due to an unhandled exception. Exception Info: System.InvalidOperationException at
System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited) at
System.Diagnostics.Process.OpenProcessHandle(Int32 access) at
System.Diagnostics.Process.set_EnableRaisingEvents(Boolean value) at
Microsoft.Alm.Remoting.RemoteContainer.ServerHost.Execute(String clientObjectUri, Process parentProcess) at
Microsoft.Alm.Remoting.RemoteContainer.EntryPoint.ExecuteInOtherAppDomain(String clientObjectUri, Int32 parentProcessId) at
Microsoft.Alm.Remoting.RemoteContainer+EntryPoint.ExecuteInOtherAppDomain(System.String, Int32) at
Microsoft.Alm.Remoting.RemoteContainer+EntryPoint.Main(System.String[])</Data>
</EventData>
</Event>
I have a simple Windows Forms App. It was working alright before the update. Now it's not working. It starts as process but nothing more. No UI shows up. When I open the solution and choose some cs or designer files a loading message box shows saying "Opening the file..." and loads endlessly.
I have another simple launcher for the Mail App.
public static void Main()
{
Process.Start("explorer", #"shell:Appsfolder\microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail");
}
It's not working any more. O_o If I type the shell explorer shell:Appsfolder\microsoft.windowscommunicationsapps_8wekyb3d8bbwe!microsoft.windowslive.mail through Run it is working fine though. What have they done to the new Windows?
I don't know if this is the right place to ask this, but I'm getting an error in my eventlog every time I open my TFS webpage I get the following error:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Team Foundation Server" Guid="{80761876-6844-47D5-8106-F8ED2AA8687B}" />
<EventID>0</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>1</Task>
<Opcode>10</Opcode>
<Keywords>0x8000000000000001</Keywords>
<TimeCreated SystemTime="2016-02-24T14:48:40.361409100Z" />
<EventRecordID>650</EventRecordID>
<Correlation ActivityID="{72451AFD-6F04-0000-3340-4572046FD101}" />
<Execution ProcessID="3932" ThreadID="808" />
<Channel>Microsoft-Team Foundation Server/Debug</Channel>
<Computer>WIN-U8K4FA701IJ</Computer>
<Security UserID="S-1-5-19" />
</System>
<UserData>
<Info TraceId="{00000001-0001-0001-0000-000000000000}" xmlns="http://schemas.microsoft.com/TeamFoundation/2010/Framework">
<Tracepoint>599999</Tracepoint>
<ServiceHost>{00000000-0000-0000-0000-000000000000}</ServiceHost>
<ContextId>0</ContextId>
<ProcessName>w3wp</ProcessName>
<Username />
<Service />
<Method />
<Area>WebAccess</Area>
<Layer>Controller</Layer>
<UserAgent />
<Uri />
<Path />
<UserDefined />
<Message>System.Reflection.ReflectionTypeLoadException: Kan een of meer van de gevraagde typen niet laden. Haal de LoaderExceptions-eigenschap op voor meer informatie. bij System.Reflection.RuntimeModule.GetTypes(RuntimeModule module) bij System.Reflection.RuntimeModule.GetTypes() bij System.Reflection.Assembly.GetTypes() bij Microsoft.TeamFoundation.Server.WebAccess.TypeUtils.GetAllTypes(IEnumerable`1 assemblies, Func`2 filter)</Message>
</Info>
</UserData>
</Event>
I tried re-installing everything but it didn't bother.
Who knows what is giving me this error?
First, translate the error message into English to make it readable:
<Message>System.Reflection.ReflectionTypeLoadException: Unable to load one or more of the requested types. Retrieve the LoaderExceptions property for more information.
at System.Reflection.RuntimeModule.GetTypes(RuntimeModule module)
at System.Reflection.RuntimeModule.GetTypes()
at System.Reflection.Assembly.GetTypes()
at Microsoft.TeamFoundation.Server.WebAccess.TypeUtils.GetAllTypes(IEnumerable`1 assemblies, Func`2 filter)</Message>
This error may be caused by various factors, for example, if you don't configure build service well. Try to install the TFS 2012 Power Tools, then run the BPA to scan your TFS 2012 Server, you may get something useful.
I would like to get all the provider names of Event Viewer using C#. Please see below the sample provider
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Team Foundation Server" Guid="{80761876-6844-47D5-8106-F8ED2AA8687B}" />!`<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Team Foundation Server" Guid="{80761876-6844-47D5-8106-F8ED2AA8687B}" />
How can I get these providers list?
Use the EventLogSession.GetProviderNames method like this:
EventLogSession session = new EventLogSession();
var providers = session.GetProviderNames().ToList();
The following is a log event generated by ActiveDirectory. I have an application that reads such logs and processes them. I want to make a test-application that will simulate active directory events and write similar logs to Windows event log.
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="SIMULATOR" />
<EventID Qualifiers="0">4769</EventID>
<Level>0</Level>
<Task>0</Task>
<Keywords>0xa0000000000000</Keywords>
<TimeCreated SystemTime="2014-02-03T10:52:20.000000000Z" />
<EventRecordID>35215</EventRecordID>
<Channel>Application</Channel>
<Computer>dev.local</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserName">WIN2K8R2-PCX$</Data>
<Data Name="TargetDomainName">dev.local</Data>
<Data Name="TargetSid">S-1-5-21-527455857-2257904818-3601372424-1001</Data>
<Data Name="ServiceName">Administrator</Data>
<Data Name="ServiceSid">S-1-5-21-527455857-2257904818-3601372424-502</Data>
<Data Name="TicketOptions">0x40810010</Data>
<Data Name="Status">0x0</Data>
<Data Name="TicketEncryptionType">0x12</Data>
<Data Name="PreAuthType">2</Data>
<Data Name="IpAddress">84.1.24.45</Data>
<Data Name="IpPort">0</Data>
<Data Name="CertIssuerName" />
<Data Name="CertSerialNumber" />
<Data Name="CertThumbprint" />
</EventData>
Please note that are multiple Data elements inside EventData element!
If I use the following, I do get multiple data elements but how do specify the Name attribute of each Data element?
string [] eventLog = new string[] {"A", "S", "D"};
EventLog log = new EventLog {Source = "source"};
log.WriteEvent(eventInstance, eventLog);
On this article I found that I can use the manifest registered by ActiveDirectory by using EventDescriptor/EventProvider. But that doesn't write anything in event log.
I found active directory guids by following the steps given here . On my system the guids are as follows
Active Directory Domain Services: SAM {8E598056-8993-11D2-819E-0000F875A064}
Active Directory: Kerberos Client {BBA3ADD2-C229-4CDB-AE2B-57EB6966B0C4}
Active Directory: NetLogon {F33959B4-DBEC-11D2-895B-00C04F79AB69}
Here's one way
From the way I read it, you need to:
Use ManifestGenerator (EcManGen.exe) to create a manifest skeleton for your app.
Use the manifest to describe the data you want to persist.
Use ManifestCompiler (mc.exe) to compile the manifest, resulting in (among other things) a .cs and .rc file.
Use ResourceCompiler (rc.exe) to compile the .rc into a real resource (.res)
Use the C# Compiler (csc.exe) to compile the .cs and .res files into an assembly. (needs to use /unsafe)
Add the assembly to your project.
As an admin, run wevutil to add the manifest to the machine on which these logs will be logged.
Once all of this is done, you can use the EventProvider from the assembly or the regular EventProvider (with a custom EventDescriptor).