using System; using System.Diagnostics; using System.Linq; namespace BizTalkCheckmkPulse { internal sealed class EventLogProbe { private readonly MonitoringOptions _options; public EventLogProbe(MonitoringOptions options) { _options = options; } public void Query(ProbeResult result) { result.EventLog.Since = DateTime.Now.AddMinutes(-_options.EventLogLookbackMinutes); try { using (var log = new EventLog("Application", ".")) { var entries = log.Entries; for (var i = entries.Count - 1; i >= 0; i--) { var entry = entries[i]; if (entry.TimeGenerated < result.EventLog.Since) { break; } if (!IsRelevantSource(entry.Source)) { continue; } if (entry.EntryType == EventLogEntryType.Error) { result.EventLog.Errors++; } else if (entry.EntryType == EventLogEntryType.Warning) { result.EventLog.Warnings++; } } } result.EventLog.Available = true; } catch (Exception ex) { result.EventLog.Available = false; result.EventLog.Failure = ex.GetType().Name + ": " + ex.Message; } } private bool IsRelevantSource(string source) { if (string.IsNullOrWhiteSpace(source)) { return false; } return _options.EventLogSources.Any(x => source.IndexOf(x, StringComparison.OrdinalIgnoreCase) >= 0); } } }