title: How can i collect all the system event logs and save them to a file?
body: <p>Im trying to use this function:</p>
  
  <pre><code>public void DoBackup(string sLogName)
  {
      string sBackup = sLogName;  // could be for example "Application"
      EventLog log = new EventLog();
      log.Source = sBackup;
  
      var query = from EventLogEntry entry in log.Entries
                  orderby entry.TimeGenerated descending
                  select entry;
  
      string sBackupName = sBackup + "Log";
      var xml = new XDocument(
          new XElement(sBackupName,
              from EventLogEntry entry in log.Entries
              orderby entry.TimeGenerated descending
              select new XElement("Log",
                new XElement("Message", entry.Message),
                new XElement("TimeGenerated", entry.TimeGenerated),
                new XElement("Source", entry.Source),
                new XElement("EntryType", entry.EntryType.ToString())
              )
            )
          );
  
      DateTime oggi = DateTime.Now;
      string sToday = DateTime.Now.ToString("yyyyMMdd_hhmmss");
      string path = String.Format("{0}_{1}.xml", sBackupName, sToday);
      xml.Save(Path.Combine(Environment.CurrentDirectory, path));
  }
  </code></pre>
  
  <p>In general i want to create two files:</p>
  
  <ol>
  <li>Text file of all the app event logs.</li>
  <li>Text file of all the system event logs.</li>
  </ol>
  
  <p>I called this function like this:</p>
  
  <p>DoBackup("test");
  But when running it im getting an exception on :</p>
  
  <pre><code>var xml = new XDocument(
      new XElement(sBackupName,
          from EventLogEntry entry in log.Entries
          orderby entry.TimeGenerated descending
          select new XElement("Log",
            new XElement("Message", entry.Message),
            new XElement("TimeGenerated", entry.TimeGenerated),
            new XElement("Source", entry.Source),
            new XElement("EntryType", entry.EntryType.ToString())
          )
        )
      );
  </code></pre>
  
  <p>Log property value has not been specified</p>
  
  <pre><code>System.ArgumentException was unhandled
    HResult=-2147024809
    Message=Log property value has not been specified.
    Source=System
    StackTrace:
         at System.Diagnostics.EventLogInternal.OpenForRead(String currentMachineName)
         at System.Diagnostics.EventLogInternal.GetEntryAtNoThrow(Int32 index)
         at System.Diagnostics.EventLogEntryCollection.EntriesEnumerator.MoveNext()
         at System.Linq.Enumerable.&lt;CastIterator&gt;d__b1`1.MoveNext()
         at System.Linq.Buffer`1..ctor(IEnumerable`1 source)
         at System.Linq.OrderedEnumerable`1.&lt;GetEnumerator&gt;d__0.MoveNext()
         at System.Linq.Enumerable.WhereSelectEnumerableIterator`2.MoveNext()
         at System.Xml.Linq.XContainer.AddContentSkipNotify(Object content)
         at System.Xml.Linq.XElement..ctor(XName name, Object content)
         at Diagnostic_Tool_Blue_Screen.Form1.DoBackup(String sLogName) in d:\C-Sharp\Diagnostic Tool Blue Screen\Diagnostic Tool Blue Screen\Diagnostic Tool Blue Screen\Form1.cs:line 161
         at Diagnostic_Tool_Blue_Screen.Form1.Diagnose_Click(Object sender, EventArgs e) in d:\C-Sharp\Diagnostic Tool Blue Screen\Diagnostic Tool Blue Screen\Diagnostic Tool Blue Screen\Form1.cs:line 57
         at System.Windows.Forms.Control.OnClick(EventArgs e)
         at System.Windows.Forms.Button.OnClick(EventArgs e)
         at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
         at System.Windows.Forms.Control.WmMouseUp(Message&amp; m, MouseButtons button, Int32 clicks)
         at System.Windows.Forms.Control.WndProc(Message&amp; m)
         at System.Windows.Forms.ButtonBase.WndProc(Message&amp; m)
         at System.Windows.Forms.Button.WndProc(Message&amp; m)
         at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message&amp; m)
         at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message&amp; m)
         at System.Windows.Forms.NativeWindow.DebuggableCallback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)
         at System.Windows.Forms.UnsafeNativeMethods.DispatchMessageW(MSG&amp; msg)
         at System.Windows.Forms.Application.ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(IntPtr dwComponentID, Int32 reason, Int32 pvLoopData)
         at System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner(Int32 reason, ApplicationContext context)
         at System.Windows.Forms.Application.ThreadContext.RunMessageLoop(Int32 reason, ApplicationContext context)
         at System.Windows.Forms.Application.Run(Form mainForm)
         at Diagnostic_Tool_Blue_Screen.Program.Main() in d:\C-Sharp\Diagnostic Tool Blue Screen\Diagnostic Tool Blue Screen\Diagnostic Tool Blue Screen\Program.cs:line 19
         at System.AppDomain._nExecuteAssembly(RuntimeAssembly assembly, String[] args)
         at System.AppDomain.ExecuteAssembly(String assemblyFile, Evidence assemblySecurity, String[] args)
         at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
         at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
         at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
         at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
         at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
         at System.Threading.ThreadHelper.ThreadStart()
    InnerException: 
  </code></pre>
  
  <hr>
  
  <p>In the end the content of the text file on my hard disk should look like this :</p>
  
  <pre><code>Event[0]:
    Log Name: System
    Source: EventLog
    Date: 2013-01-17T03:19:18.000
    Event ID: 6011
    Task: N/A
    Level: Information
    Opcode: N/A
    Keyword: Classic
    User: N/A
    User Name: N/A
    Computer: windows-uj49s6b
    Description: 
  The NetBIOS name and DNS host name of this machine have been changed from WINDOWS-UJ49S6B to WIN-F1MN9CTN28S.
  
  Event[1]:
    Log Name: System
  </code></pre>
  
  <p>EventApp text file which is 18mb and EventSys text file which is about 3mb .</p>