Get TaskName from TaskScheduler Event Log

Question

I'm trying to access the information available in the "Details" tab in Event Viewer.

I've realized the TaskScheduler events aren't available via the System.Diagnostics.EventLog, but instead via System.Diagnostics.Eventing.

So far I've got this:

var query = new EventLogQuery("Microsoft-Windows-TaskScheduler/Operational", PathType.LogName);
var reader = new EventLogReader(query);
var eventRec = reader.ReadEvent();

But I cant find the EventData anywhere in the returned object.

I'm trying to find this info (Guid's removed), specifically the "EventData->TaskName":

< Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
< System>
< Provider Name="Microsoft-Windows-TaskScheduler" Guid="...." /> 
< EventID>110</EventID> 
< Version>0</Version> 
< Level>4</Level> 
< Task>110</Task> 
< Opcode>0</Opcode> 
< Keywords>0x8000000000000000</Keywords> 
< TimeCreated SystemTime="2011-12-21T17:51:13.029864700Z" /> 
< EventRecordID>203307</EventRecordID> 
< Correlation ActivityID="{090...440}" /> 
< Execution ProcessID="996" ThreadID="9932" /> 
< Channel>Microsoft-Windows-TaskScheduler/Operational</Channel> 
< Computer>....</Computer> 
< Security UserID="S-1-5-18" /> 
< /System>
< EventData Name="TaskRunEvent">
**< Data Name="TaskName">\testTask</Data>** 
< Data Name="InstanceId">{090...440}</Data> 
< Data Name="UserContext">cussonsh</Data> 
< /EventData>      < /Event>

Answer 1

EventData is in EventRecord.Properties. I.e. in your case it would be eventRec.Properties.

But those Properties are IList, and EventProperty class has only a value field, but not the name. And I'm not sure how you can retrieve it... But you should still be able to use EventRecord.ToXml() method to get an XML representation (exactly like you showed) and then retrieve names/values from that XML.