C# Exporting event logs using EventLogSession create .tmp files

Question

I am using the following code to export some event logs:

EventLogSession eventLogSession = new EventLogSession(machineName);
eventLogSession.ExportLogAndMessages(logName, PathType.LogName, query, remoteTempFile);

I have noticed that each time this method is invoked, it creates .tmp files in: C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp like: EVT14B4.tmp, EVTA3Bc.tmp...

You get the idea.

Why is that hapenning? Is there a way to delete it at the end of the operation automatically ? If not, should I delete it manually?

LJH LJH · Accepted Answer · 2020-04-26T16:18:17

I cannot replicate the creation of the temp files, using the following code, running on Windows 10, Visual Studio 2019, .NET Core 3.1 Console App. I installed the NuGet package System.Diagnostics.EventLog:

 static void Main()
        {
            EventLogSession eventLogSession = new EventLogSession("yourComputerName");
            eventLogSession.ExportLogAndMessages("Application", PathType.LogName, "*", "c:\\temp\\Application.log");
            eventLogSession.ExportLogAndMessages("System", PathType.LogName, "*", "c:\\temp\\System.log");
        }

The logs are 10MB & 6MB respectively and are exported within a couple of seconds to the specified path. Are the logs you are choosing particularly large?

The temp files are unlikely to be needed; delete them manually or code something to delete them after your logs are dumped.

Out of curiosity, you could try manually exporting these logs from within Event Viewer, to see if the temp files are created by Event Viewer. Also, if permitted, try reducing the size within Event Viewer, and then run your code, to see if the temp files are created still.

C# Exporting event logs using EventLogSession create .tmp files

1 Answers