How to get all properties of event viewer file(.evtx)?

Question

Hi All I am writing a Text file which is containing all properties of .Evtx file. While retiring the properties of event viewer file (.evtx) sometimes some properties values are coming as a null. for example below properties: LevelDisplayName TaskDisplayName EventID I am getting null values for them sometimes. So I want to ask is there any other properties which have same values so that I can read values. Thanks What I have tried: I tried to search all properties while debugging but not able to find.

Sumit Kumawat · Answer

hi manas my path is correct and even im able to fetching all values from properties. it is just in case sometime some properties values are returning null value.

Manas Mohapatra · Answer

To resolve your issue: 1. Make sure the path is correct(evtx) 2. EventID can't be null. Just loop over the file and see if same EventID is present in EventLog. It may be some junk data present in the file. https://stackoverflow.com/questions/30809133/read-event-log-file-from-path https://phejndorf.wordpress.com/2011/03/31/using-c-and-linq-to-read-a-windows-eventlog-file-evtx/ http://www.aspheute.com/english/20000811.asp