title: How do I watch the event log for a specific entry in realtime, also getting the XML data?
body: <p>I'm building an application which should watch file for access, reading, writing, deleting.</p>
  
  <p>I'm using the built in auditing system on a Windows 7 Pro. You turn it on in gpedit.msc, and then set the audit flags for the files you want to watch, and then you get entries in the security log.</p>
  
  <p>What I want to do is watching the security log in real time, which I do like this: </p>
  
  <pre><code>static EventLog securityLog = new EventLog("Security", System.Environment.MachineName);
  
  securityLog.EntryWritten += new EntryWrittenEventHandler(OnEntryWritten);
  securityLog.EnableRaisingEvents = true;
  </code></pre>
  
  <p>This works and calls my <code>OnEntryWritten</code>-Function.</p>
  
  <pre><code>public static void OnEntryWritten(object source, EntryWrittenEventArgs entry)
  </code></pre>
  
  <p><code>entry.Entry</code> is the <code>EntryWrittenEventArgs.Entry</code> Property, which doesn't seem to give me any access to the XML-properties of the entry, which I need, beecause it contains additional information.</p>
  
  <p>What I'm trying to do afterwards is to query the event log via another <code>EventLogReader</code>, because I can get <code>entry.Entry.Index</code> which should be the <code>eventInstance.RecordId</code> of an event that I get from the <code>EventLogReader</code>. </p>
  
  <pre><code>&lt;QueryList&gt;
    &lt;Query Id="0" Path="Security"&gt;
      &lt;Select Path="Security"&gt;"&gt;*[System[(EventRecordID=181616)]]&lt;/Select&gt;
    &lt;/Query&gt;
  &lt;/QueryList&gt;
  </code></pre>
  
  <p>works as XPath query directly in the event log, it gives back just one entry.</p>
  
  <pre><code>string query = "*[System[(EventRecordID=" + entry.Entry.Index + ")]]";
  
  // Create Event Log Query and Reader
  EventLogQuery eventsQuery = new EventLogQuery("Security",
                                                PathType.LogName,
                                                query);
  
  EventLogReader logReader = new EventLogReader(eventsQuery);
  
  // For each event returned from the query
  for (EventRecord eventInstance = logReader.ReadEvent(); eventInstance != null; eventInstance = logReader.ReadEvent())
              {
                  if (eventInstance.RecordId == entry.Entry.Index)  //RecordId and Index are the same thing: the identifier of the record/entry. 
                  {
                      XDocument xml;
                      try
                      {
                          xml = XDocument.Parse(logReader.ReadEvent().ToXml());
                      }
  
                      catch (Exception e)
                      {
                          //logger.Write(e.Message.ToString());
                          break;      //We seem to have a newline character in the logReader.ReadEvent() sometimes, but nothing else, so we can safely break here or completely ignore it.
                      }
  </code></pre>
  
  <p>This fails when I try to get the xml, why is that?</p>
  
  <p>I get an "Object reference not set to an instance of an object." which is an <code>System.NullReferenceException</code>. I'm not sure how this error actually can happen.</p>
  
  <p>If I query the log like this</p>
  
  <pre><code>EventLogQuery eventsQuery = new EventLogQuery("Security",
                                                PathType.LogName,
                                                "*[EventData[Data[@Name='ObjectType'] and (Data='File')]] ");
  </code></pre>
  
  <p>it works without a problem.</p>
  
  <p>What's the best way to do this, anyway?</p>