The simplest code checked with .NET Framework 4.6.2 and .NET 6 & 7 like:
using System;
using System.Diagnostics;
using System.Linq;
namespace EventLogMessagesProcessor
{
class Program
{
static void Main(string[] args)
{
var eventLogs = EventLog.GetEventLogs().Where(eventLogAccessible).ToList();
foreach (var eventLog in eventLogs)
{
var numberOfRecords = eventLog.Entries.Count;
var copyOfTheRecords = new EventLogEntry[numberOfRecords];
eventLog.Entries.CopyTo(copyOfTheRecords, 0);
for (var i = 0; i < numberOfRecords; i++)
{
var entry = copyOfTheRecords[i];
if (entry.Message.Contains("cannot be found"))
{
Console.WriteLine("Index: {0}, InstanceId {1}, Message: {2}, Source: {3}", entry.Index, entry.InstanceId, entry.Message, entry.Source);
}
}
}
}
private static bool eventLogAccessible(EventLog log)
{
try
{
return log.Entries.Count > 0;
}
catch
{
return false;
}
}
}
}
It prints a lot of not parsed Message:
a) Index: 110479, InstanceId 107, Message: The description for Event ID '107' in Source 'Microsoft-Windows-Kernel-Power' cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'5', '5', '5', '1601-01-01T00:00:00.0000000Z', '1601-01-01T00:00:00.0000000Z', '0', '0', Source: Microsoft-Windows-Kernel-Power
b) Index: 110483, InstanceId 30, Message: The description for Event ID '30' in Source 'Microsoft-Windows-Kernel-Boot' cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'0', '18585', '18776', '22385', '22385', Source: Microsoft-Windows-Kernel-Boot
c) Index: 110551, InstanceId 44, Message: The description for Event ID '44' in Source 'Microsoft-Windows-WindowsUpdateClient' cannot be found. The local computer may not have the necessary registry information or message DLL files to display the message, or you may not have permission to access them. The following information is part of the event:'Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.395.1036.0)', '{43f98d37-e77a-4ae5-ad74-87c68e9ea677}', '200', Source: Microsoft-Windows-WindowsUpdateClient
etc... thousands of unparsed messages. But the Event Viewer does the job and shows every Message parsed.
The code is run as Admin and also as SYSTEM service. I cannot understand where is the problem? Windows? .NET? Me?
Thank you