Event Log Message Interception with WMI

Out of the box pipeline components have decent error logging, but often don't give us the flexibility to do our own thing. In addition to a suspended queue listener (see Martinjn's blog), an Event Log Watcher windows service might be a good failover mechanism. Below is some skeleton code for going about it.

using System;
using System.Collections;
using System.ComponentModel;
using System.Data;
using System.Diagnostics;
using System.ServiceProcess;
using System.Management;
using System.IO;

namespace MyEventLogWatcher
{
public class BizTalkEventLogWatcher : System.ServiceProcess.ServiceBase
{
private System.Management.ManagementEventWatcher eventLogWatcher;
///
/// Required designer variable.
///

private System.ComponentModel.Container components = null;

public BizTalkEventLogWatcher()
{
// This call is required by the Windows.Forms Component Designer.
InitializeComponent();
}

static void Main()
{
System.ServiceProcess.ServiceBase ServiceToRun;

ServiceToRun = new BizTalkEventLogWatcher();

System.ServiceProcess.ServiceBase.Run(ServiceToRun);
}
#region Component Designer generated code
///
/// Required method for Designer support - do not modify
/// the contents of this method with the code editor.
///

private void InitializeComponent()
{
this.eventLogWatcher = new System.Management.ManagementEventWatcher();
//
// eventLogWatcher
//

this.eventLogWatcher.Query = new System.Management.EventQuery("SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA \"Win32_NTLogEvent\"" +
" AND TargetInstance.Logfile = \"Application\"");

//
// BizTalkEventLogWatcher
//
this.ServiceName = "BizTalkEventLogWatcher";

}
#endregion

///
/// Clean up any resources being used.
///

protected override void Dispose( bool disposing )
{
if( disposing )
{
if (components != null)
{
components.Dispose();
}

}
base.Dispose( disposing );
}

///
/// Set things in motion so your service can do its work.
///

protected override void OnStart(string[] args)
{
eventLogWatcher.Scope = new System.Management.ManagementScope("\\\\"+Environment.MachineName+"\\root\\CIMV2");
eventLogWatcher.EventArrived += new System.Management.EventArrivedEventHandler(eventLogWatcher_EventArrived);
eventLogWatcher.Start();
}

///
/// Stop this service.
///

protected override void OnStop()
{
eventLogWatcher.Stop();
}
protected void eventLogWatcher_EventArrived(object sender, EventArrivedEventArgs e)
{
string strEventSourcesToIntercept = "";
try
{
PropertyData propData = e.NewEvent.Properties["TargetInstance"];
StringBuilder strUserFriendlyMsg = new StringBuilder();
if(propData != null)
{
ManagementBaseObject mgmtObj = propData.Value as ManagementBaseObject;
if((mgmtObj.Properties["Message"].Value != null)&&
(mgmtObj.Properties["Source"].Value.ToString().Equals("strEventSourcesToIntercept")))
{

}
}
}
catch(Exception Ex)
{
//error handling
}
}

}
}

Comments

Popular posts from this blog

Sending Messages as FORM Variables with the HTTP Adapter

Using recursion in the In-line XSLT Template type Scripting Functoid

Uniform Sequential Convoys in BTS 2004 using Correlation