Eventlog.cs

// Copyright (c) Microsoft Corporation.
// Licensed under the MIT License.

using System;
using System.Collections;
using System.Collections.Generic;
using System.ComponentModel; // Win32Exception
using System.Diagnostics; // Eventlog class
using System.Diagnostics.CodeAnalysis;
using System.Management.Automation;
using System.Management.Automation.Internal;

namespace Microsoft.PowerShell.Commands
{
    #region GetEventLogCommand
    /// <summary>
    /// This class implements the Get-EventLog command.
    /// </summary>
    /// <remarks>
    /// The CLR EventLogEntryCollection class has problems with managing
    /// rapidly spinning logs (i.e. logs set to "Overwrite" which are
    /// rapidly getting new events and discarding old events).
    /// In particular, if you enumerate forward
    ///     EventLogEntryCollection entries = log.Entries;
    ///     foreach (EventLogEntry entry in entries)
    /// it will occasionally skip an entry.  Conversely, if you are
    /// enumerating backward
    ///     EventLogEntryCollection entries = log.Entries;
    ///     int count = entries.Count;
    ///     for (int i = count-1; i >= 0; i--) {
    ///         EventLogEntry entry = entries[i];
    /// it will occasionally repeat an entry.  Accordingly, we enumerate
    /// backward and try to leave off the repeated entries.
    /// </remarks>
    [Cmdlet(VerbsCommon.Get, "EventLog", DefaultParameterSetName = "LogName",
        HelpUri = "https://go.microsoft.com/fwlink/?LinkID=113314", RemotingCapability = RemotingCapability.SupportedByCommand)]
    [OutputType(typeof(EventLog), typeof(EventLogEntry), typeof(string))]
    public sealed class GetEventLogCommand : PSCmdlet
    {
        #region Parameters
        /// <summary>
        /// Read eventlog entries from this log.
        /// </summary>
        [Parameter(Position = 0, Mandatory = true, ParameterSetName = "LogName")]
        [Alias("LN")]
        public string LogName { get; set; }

        /// <summary>
        /// Read eventlog entries from this computer.
        /// </summary>
        [Parameter]
        [ValidateNotNullOrEmpty]
        [Alias("Cn")]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public string[] ComputerName { get; set; } = Array.Empty<string>();

        /// <summary>
        /// Read only this number of entries.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        [ValidateRange(0, Int32.MaxValue)]
        public int Newest { get; set; } = Int32.MaxValue;

        /// <summary>
        /// Return entries "after " this date.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        [ValidateNotNullOrEmpty]
        public DateTime After
        {
            get { return _after; }

            set
            {
                _after = value;
                _isDateSpecified = true;
                _isFilterSpecified = true;
            }
        }

        private DateTime _after;

        /// <summary>
        /// Return entries "Before" this date.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        [ValidateNotNullOrEmpty]
        public DateTime Before
        {
            get { return _before; }

            set
            {
                _before = value;
                _isDateSpecified = true;
                _isFilterSpecified = true;
            }
        }

        private DateTime _before;

        /// <summary>
        /// Return entries for this user.Wild characters is supported.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        [ValidateNotNullOrEmpty]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public string[] UserName
        {
            get { return _username; }

            set
            {
                _username = value;
                _isFilterSpecified = true;
            }
        }

        private string[] _username;

        /// <summary>
        /// Match eventlog entries by the InstanceIds
        /// gets or sets an array of instanceIds.
        /// </summary>
        [Parameter(Position = 1, ParameterSetName = "LogName")]
        [ValidateNotNullOrEmpty]
        [ValidateRangeAttribute((long)0, long.MaxValue)]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public long[] InstanceId
        {
            get { return _instanceIds; }

            set
            {
                _instanceIds = value;
                _isFilterSpecified = true;
            }
        }

        private long[] _instanceIds = null;

        /// <summary>
        /// Match eventlog entries by the Index
        /// gets or sets an array of indexes.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        [ValidateNotNullOrEmpty]
        [ValidateRangeAttribute((int)1, int.MaxValue)]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public int[] Index
        {
            get { return _indexes; }

            set
            {
                _indexes = value;
                _isFilterSpecified = true;
            }
        }

        private int[] _indexes = null;

        /// <summary>
        /// Match eventlog entries by the EntryType
        /// gets or sets an array of EntryTypes.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        [ValidateNotNullOrEmpty]
        [ValidateSetAttribute(new string[] { "Error", "Information", "FailureAudit", "SuccessAudit", "Warning" })]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        [Alias("ET")]
        public string[] EntryType
        {
            get { return _entryTypes; }

            set
            {
                _entryTypes = value;
                _isFilterSpecified = true;
            }
        }

        private string[] _entryTypes = null;

        /// <summary>
        /// Get or sets an array of Source.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        [ValidateNotNullOrEmpty]
        [Alias("ABO")]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public string[] Source
        {
            get
            { return _sources; }

            set
            {
                _sources = value;
                _isFilterSpecified = true;
            }
        }

        private string[] _sources;

        /// <summary>
        /// Get or Set Message string to searched in EventLog.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        [ValidateNotNullOrEmpty]
        [Alias("MSG")]
        public string Message
        {
            get
            {
                return _message;
            }

            set
            {
                _message = value;
                _isFilterSpecified = true;
            }
        }

        private string _message;

        /// <summary>
        /// Returns Log Entry as base object.
        /// </summary>
        [Parameter(ParameterSetName = "LogName")]
        public SwitchParameter AsBaseObject { get; set; }

        /// <summary>
        /// Return the Eventlog objects rather than the log contents.
        /// </summary>
        [Parameter(ParameterSetName = "List")]
        public SwitchParameter List { get; set; }

        /// <summary>
        /// Return the log names rather than the EventLog objects.
        /// </summary>
        [Parameter(ParameterSetName = "List")]
        public SwitchParameter AsString
        {
            get
            {
                return _asString;
            }

            set
            {
                _asString = value;
            }
        }

        private bool _asString /* = false */;
        #endregion Parameters

        #region Overrides

        /// <summary>
        /// Sets true when Filter is Specified.
        /// </summary>
        private bool _isFilterSpecified = false;
        private bool _isDateSpecified = false;
        private bool _isThrowError = true;

        /// <summary>
        /// Process the specified logs.
        /// </summary>
        protected override void BeginProcessing()
        {
            if (ParameterSetName == "List")
            {
                if (ComputerName.Length > 0)
                {
                    foreach (string computerName in ComputerName)
                    {
                        foreach (EventLog log in EventLog.GetEventLogs(computerName))
                        {
                            if (AsString)
                                WriteObject(log.Log);
                            else
                                WriteObject(log);
                        }
                    }
                }
                else
                {
                    foreach (EventLog log in EventLog.GetEventLogs())
                    {
                        if (AsString)
                            WriteObject(log.Log);
                        else
                            WriteObject(log);
                    }
                }
            }
            else
            {
                Diagnostics.Assert(ParameterSetName == "LogName", "Unexpected parameter set");

                if (!WildcardPattern.ContainsWildcardCharacters(LogName))
                {
                    OutputEvents(LogName);
                }
                else
                {
                    //
                    // If we were given a wildcard that matches more than one log, output the matching logs. Otherwise output the events in the matching log.
                    //
                    List<EventLog> matchingLogs = GetMatchingLogs(LogName);

                    if (matchingLogs.Count == 1)
                    {
                        OutputEvents(matchingLogs[0].Log);
                    }
                    else
                    {
                        foreach (EventLog log in matchingLogs)
                        {
                            WriteObject(log);
                        }
                    }
                }
            }
        }
        #endregion Overrides

        #region Private

        private void OutputEvents(string logName)
        {
            // 2005/04/21-JonN This somewhat odd structure works
            // around the FXCOP DisposeObjectsBeforeLosingScope rule.
            bool processing = false;
            try
            {
                if (ComputerName.Length == 0)
                {
                    using (EventLog specificLog = new EventLog(logName))
                    {
                        processing = true;
                        Process(specificLog);
                    }
                }
                else
                {
                    processing = true;

                    foreach (string computerName in ComputerName)
                    {
                        using (EventLog specificLog = new EventLog(logName, computerName))
                        {
                            Process(specificLog);
                        }
                    }
                }
            }
            catch (InvalidOperationException e)
            {
                if (processing)
                {
                    throw;
                }

                ThrowTerminatingError(new ErrorRecord(
                    e, // default exception text is OK
                    "EventLogNotFound",
                    ErrorCategory.ObjectNotFound,
                    logName));
            }
        }

        private void Process(EventLog log)
        {
            bool matchesfound = false;
            if (Newest == 0)
            {
                return;
            }

            // enumerate backward, skipping repeat entries
            EventLogEntryCollection entries = log.Entries;

            int count = entries.Count;
            int lastindex = Int32.MinValue;
            int processed = 0;

            for (int i = count - 1; (i >= 0) && (processed < Newest); i--)
            {
                EventLogEntry entry = null;
                try
                {
                    entry = entries[i];
                }
                catch (ArgumentException e)
                {
                    ErrorRecord er = new ErrorRecord(
                        e,
                        "LogReadError",
                        ErrorCategory.ReadError,
                        null
                        );
                    er.ErrorDetails = new ErrorDetails(
                        this,
                        "EventlogResources",
                        "LogReadError",
                        log.Log,
                        e.Message
                        );
                    WriteError(er);

                    // NTRAID#Windows Out Of Band Releases-2005/09/27-JonN
                    // Break after the first one, rather than repeating this
                    // over and over
                    break;
                }
                catch (Exception e)
                {
                    Diagnostics.Assert(false,
                        "EventLogEntryCollection error "
                       + e.GetType().FullName
                        + ": " + e.Message);
                    throw;
                }

                if ((entry != null) &&
                ((lastindex == Int32.MinValue
                  || lastindex - entry.Index == 1)))
                {
                    lastindex = entry.Index;
                    if (_isFilterSpecified)
                    {
                        if (!FiltersMatch(entry))
                            continue;
                    }

                    if (!AsBaseObject)
                    {
                        // wrapping in PSobject to insert into PStypesnames
                        PSObject logentry = new PSObject(entry);
                        // inserting at zero position in reverse order
                        logentry.TypeNames.Insert(0, logentry.ImmediateBaseObject + "#" + log.Log + "/" + entry.Source);
                        logentry.TypeNames.Insert(0, logentry.ImmediateBaseObject + "#" + log.Log + "/" + entry.Source + "/" + entry.InstanceId);
                        WriteObject(logentry);
                        matchesfound = true;
                    }
                    else
                    {
                        WriteObject(entry);
                        matchesfound = true;
                    }

                    processed++;
                }
            }

            if (!matchesfound && _isThrowError)
            {
                Exception Ex = new ArgumentException(StringUtil.Format(EventlogResources.NoEntriesFound, log.Log, string.Empty));
                WriteError(new ErrorRecord(Ex, "GetEventLogNoEntriesFound", ErrorCategory.ObjectNotFound, null));
            }
        }

        private bool FiltersMatch(EventLogEntry entry)
        {
            if (_indexes != null)
            {
                if (!((IList)_indexes).Contains(entry.Index))
                {
                    return false;
                }
            }

            if (_instanceIds != null)
            {
                if (!((IList)_instanceIds).Contains(entry.InstanceId))
                {
                    return false;
                }
            }

            if (_entryTypes != null)
            {
                bool entrymatch = false;
                foreach (string type in _entryTypes)
                {
                    if (type.Equals(entry.EntryType.ToString(), StringComparison.OrdinalIgnoreCase))
                    {
                        entrymatch = true;
                        break;
                    }
                }

                if (!entrymatch)
                {
                    return entrymatch;
                }
            }

            if (_sources != null)
            {
                bool sourcematch = false;
                foreach (string source in _sources)
                {
                    if (WildcardPattern.ContainsWildcardCharacters(source))
                    {
                        _isThrowError = false;
                    }

                    WildcardPattern wildcardpattern = WildcardPattern.Get(source, WildcardOptions.IgnoreCase);
                    if (wildcardpattern.IsMatch(entry.Source))
                    {
                        sourcematch = true;
                        break;
                    }
                }

                if (!sourcematch)
                {
                    return sourcematch;
                }
            }

            if (_message != null)
            {
                if (WildcardPattern.ContainsWildcardCharacters(_message))
                {
                    _isThrowError = false;
                }

                WildcardPattern wildcardpattern = WildcardPattern.Get(_message, WildcardOptions.IgnoreCase);
                if (!wildcardpattern.IsMatch(entry.Message))
                {
                    return false;
                }
            }

            if (_username != null)
            {
                bool usernamematch = false;
                foreach (string user in _username)
                {
                    _isThrowError = false;
                    if (entry.UserName != null)
                    {
                        WildcardPattern wildcardpattern = WildcardPattern.Get(user, WildcardOptions.IgnoreCase);
                        if (wildcardpattern.IsMatch(entry.UserName))
                        {
                            usernamematch = true;
                            break;
                        }
                    }
                }

                if (!usernamematch)
                {
                    return usernamematch;
                }
            }

            if (_isDateSpecified)
            {
                _isThrowError = false;
                bool datematch = false;
                if (!_after.Equals(_initial) && _before.Equals(_initial))
                {
                    if (entry.TimeGenerated > _after)
                    {
                        datematch = true;
                    }
                }
                else if (!_before.Equals(_initial) && _after.Equals(_initial))
                {
                    if (entry.TimeGenerated < _before)
                    {
                        datematch = true;
                    }
                }
                else if (!_after.Equals(_initial) && !_before.Equals(_initial))
                {
                    if (_after > _before || _after == _before)
                    {
                        if ((entry.TimeGenerated > _after) || (entry.TimeGenerated < _before))
                            datematch = true;
                    }
                    else
                    {
                        if ((entry.TimeGenerated > _after) && (entry.TimeGenerated < _before))
                        {
                            datematch = true;
                        }
                    }
                }

                if (!datematch)
                {
                    return datematch;
                }
            }

            return true;
        }

        private List<EventLog> GetMatchingLogs(string pattern)
        {
            WildcardPattern wildcardPattern = WildcardPattern.Get(pattern, WildcardOptions.IgnoreCase);
            List<EventLog> matchingLogs = new List<EventLog>();
            if (ComputerName.Length == 0)
            {
                foreach (EventLog log in EventLog.GetEventLogs())
                {
                    if (wildcardPattern.IsMatch(log.Log))
                    {
                        matchingLogs.Add(log);
                    }
                }
            }
            else
            {
                foreach (string computerName in ComputerName)
                {
                    foreach (EventLog log in EventLog.GetEventLogs(computerName))
                    {
                        if (wildcardPattern.IsMatch(log.Log))
                        {
                            matchingLogs.Add(log);
                        }
                    }
                }
            }

            return matchingLogs;
        }
        // private string ErrorBase = "EventlogResources";
        private DateTime _initial = new DateTime();

        #endregion Private
    }
    #endregion GetEventLogCommand

    #region ClearEventLogCommand
    /// <summary>
    /// This class implements the Clear-EventLog command.
    /// </summary>

    [Cmdlet(VerbsCommon.Clear, "EventLog", SupportsShouldProcess = true,
        HelpUri = "https://go.microsoft.com/fwlink/?LinkID=135198", RemotingCapability = RemotingCapability.SupportedByCommand)]
    public sealed class ClearEventLogCommand : PSCmdlet
    {
        #region Parameters
        /// <summary>
        /// Clear these logs.
        /// </summary>
        [Parameter(Position = 0, Mandatory = true, ValueFromPipelineByPropertyName = true)]
        [Alias("LN")]
        [ValidateNotNullOrEmpty]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public string[] LogName { get; set; }

        /// <summary>
        /// Clear eventlog entries from these Computers.
        /// </summary>
        [Parameter(Position = 1, ValueFromPipelineByPropertyName = true)]
        [ValidateNotNullOrEmpty]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        [Alias("Cn")]
        public string[] ComputerName { get; set; } = { "." };

        #endregion Parameters

        #region Overrides

        /// <summary>
        /// Does the processing.
        /// </summary>
        protected override void BeginProcessing()
        {
            string computer = string.Empty;
            foreach (string compName in ComputerName)
            {
                if ((compName.Equals("localhost", StringComparison.OrdinalIgnoreCase)) || (compName.Equals(".", StringComparison.OrdinalIgnoreCase)))
                {
                    computer = "localhost";
                }
                else
                {
                    computer = compName;
                }

                foreach (string eventString in LogName)
                {
                    try
                    {
                        if (!EventLog.Exists(eventString, compName))
                        {
                            ErrorRecord er = new ErrorRecord(new InvalidOperationException(StringUtil.Format(EventlogResources.LogDoesNotExist, eventString, computer)), null, ErrorCategory.InvalidOperation, null);
                            WriteError(er);
                            continue;
                        }

                        if (!ShouldProcess(StringUtil.Format(EventlogResources.ClearEventLogWarning, eventString, computer)))
                        {
                            continue;
                        }

                        EventLog Log = new EventLog(eventString, compName);
                        Log.Clear();
                    }
                    catch (System.IO.IOException)
                    {
                        ErrorRecord er = new ErrorRecord(new System.IO.IOException(StringUtil.Format(EventlogResources.PathDoesNotExist, null, computer)), null, ErrorCategory.InvalidOperation, null);
                        WriteError(er);
                        continue;
                    }
                    catch (Win32Exception)
                    {
                        ErrorRecord er = new ErrorRecord(new Win32Exception(StringUtil.Format(EventlogResources.NoAccess, null, computer)), null, ErrorCategory.PermissionDenied, null);
                        WriteError(er);
                        continue;
                    }
                    catch (InvalidOperationException)
                    {
                        ErrorRecord er = new ErrorRecord(new InvalidOperationException(StringUtil.Format(EventlogResources.OSWritingError)), null, ErrorCategory.ReadError, null);
                        WriteError(er);
                        continue;
                    }
                }
            }
        }

        // beginprocessing

        #endregion Overrides
    }
    #endregion ClearEventLogCommand

    #region WriteEventLogCommand
    /// <summary>
    /// This class implements the Write-EventLog command.
    /// </summary>

    [Cmdlet(VerbsCommunications.Write, "EventLog", HelpUri = "https://go.microsoft.com/fwlink/?LinkID=135281", RemotingCapability = RemotingCapability.SupportedByCommand)]
    public sealed class WriteEventLogCommand : PSCmdlet
    {
        #region Parameters
        /// <summary>
        /// Write eventlog entries in this log.
        /// </summary>
        [Parameter(Position = 0, Mandatory = true)]
        [Alias("LN")]
        [ValidateNotNullOrEmpty]
        public string LogName { get; set; }

        /// <summary>
        /// The source by which the application is registered on the specified computer.
        /// </summary>
        [Parameter(Position = 1, Mandatory = true)]
        [Alias("SRC")]
        [ValidateNotNullOrEmpty]
        public string Source { get; set; }

        /// <summary>
        /// String which represents One of the EventLogEntryType values.
        /// </summary>
        [Parameter(Position = 3)]
        [Alias("ET")]
        [ValidateNotNullOrEmpty]
        [ValidateSetAttribute(new string[] { "Error", "Information", "FailureAudit", "SuccessAudit", "Warning" })]
        public EventLogEntryType EntryType { get; set; } = EventLogEntryType.Information;

        /// <summary>
        /// The application-specific subcategory associated with the message.
        /// </summary>
        [Parameter]
        public Int16 Category { get; set; } = 1;

        /// <summary>
        /// The application-specific identifier for the event.
        /// </summary>
        [Parameter(Position = 2, Mandatory = true)]
        [Alias("ID", "EID")]
        [ValidateNotNullOrEmpty]
        [ValidateRange(0, UInt16.MaxValue)]
        public Int32 EventId { get; set; }

        /// <summary>
        /// The message goes here.
        /// </summary>
        [Parameter(Position = 4, Mandatory = true)]
        [Alias("MSG")]
        [ValidateNotNullOrEmpty]
        [ValidateLength(0, 32766)]
        public string Message { get; set; }

        /// <summary>
        /// Write eventlog entries of this log.
        /// </summary>
        [Parameter]
        [Alias("RD")]
        [ValidateNotNullOrEmpty]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public byte[] RawData { get; set; }

        /// <summary>
        /// Write eventlog entries of this log.
        /// </summary>
        [Parameter]
        [Alias("CN")]
        [ValidateNotNullOrEmpty]

        public string ComputerName { get; set; } = ".";

        #endregion Parameters
        #region private

        private void WriteNonTerminatingError(Exception exception, string errorId, string errorMessage,
            ErrorCategory category)
        {
            Exception ex = new Exception(errorMessage, exception);
            WriteError(new ErrorRecord(ex, errorId, category, null));
        }

        #endregion private
        #region Overrides

        /// <summary>
        /// Does the processing.
        /// </summary>
        protected override void BeginProcessing()
        {
            string _computerName = string.Empty;
            if ((ComputerName.Equals("localhost", StringComparison.OrdinalIgnoreCase)) || (ComputerName.Equals(".", StringComparison.OrdinalIgnoreCase)))
            {
                _computerName = "localhost";
            }
            else
            {
                _computerName = ComputerName;
            }

            try
            {
                if (!(EventLog.SourceExists(Source, ComputerName)))
                {
                    ErrorRecord er = new ErrorRecord(new InvalidOperationException(StringUtil.Format(EventlogResources.SourceDoesNotExist, null, _computerName, Source)), null, ErrorCategory.InvalidOperation, null);
                    WriteError(er);
                }
                else
                {
                    if (!(EventLog.Exists(LogName, ComputerName)))
                    {
                        ErrorRecord er = new ErrorRecord(new InvalidOperationException(StringUtil.Format(EventlogResources.LogDoesNotExist, LogName, _computerName)), null, ErrorCategory.InvalidOperation, null);
                        WriteError(er);
                    }
                    else
                    {
                        EventLog _myevent = new EventLog(LogName, ComputerName, Source);
                        _myevent.WriteEntry(Message, EntryType, EventId, Category, RawData);
                    }
                }
            }
            catch (ArgumentException ex)
            {
                WriteNonTerminatingError(ex, ex.Message, ex.Message, ErrorCategory.InvalidOperation);
            }
            catch (InvalidOperationException ex)
            {
                WriteNonTerminatingError(ex, "AccessDenied", StringUtil.Format(EventlogResources.AccessDenied, LogName, null, Source), ErrorCategory.PermissionDenied);
            }
            catch (Win32Exception ex)
            {
                WriteNonTerminatingError(ex, "OSWritingError", StringUtil.Format(EventlogResources.OSWritingError, null, null, null), ErrorCategory.WriteError);
            }
            catch (System.IO.IOException ex)
            {
                WriteNonTerminatingError(ex, "PathDoesNotExist", StringUtil.Format(EventlogResources.PathDoesNotExist, null, ComputerName, null), ErrorCategory.InvalidOperation);
            }
        }

        #endregion Overrides
    }
    #endregion WriteEventLogCommand

    #region LimitEventLogCommand
    /// <summary>
    /// This class implements the Limit-EventLog command.
    /// </summary>

    [Cmdlet(VerbsData.Limit, "EventLog", SupportsShouldProcess = true,
        HelpUri = "https://go.microsoft.com/fwlink/?LinkID=135227", RemotingCapability = RemotingCapability.SupportedByCommand)]
    public sealed class LimitEventLogCommand : PSCmdlet
    {
        #region Parameters
        /// <summary>
        /// Limit the properties of this log.
        /// </summary>
        [Parameter(Position = 0, Mandatory = true)]
        [Alias("LN")]
        [ValidateNotNullOrEmpty]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public string[] LogName { get; set; }

        /// <summary>
        /// Limit eventlog entries of this computer.
        /// </summary>
        [Parameter]
        [Alias("CN")]
        [ValidateNotNullOrEmpty]
        [SuppressMessage("Microsoft.Performance", "CA1819:PropertiesShouldNotReturnArrays")]
        public string[] ComputerName { get; set; } = { "." };

        /// <summary>
        /// Minimum retention days for this log.
        /// </summary>
        [Parameter]
        [Alias("MRD")]
        [ValidateNotNullOrEmpty]
        [ValidateRange(1, 365)]
        public Int32 RetentionDays
        {
            get { return _retention; }

            set
            {
                _retention = value;
                _retentionSpecified = true;
            }
        }

        private Int32 _retention;
        private bool _retentionSpecified = false;
        /// <summary>
        /// Overflow action to be taken.
        /// </summary>
        [Parameter]
        [Alias("OFA")]
        [ValidateNotNullOrEmpty]
        [ValidateSetAttribute(new string[] { "OverwriteOlder", "OverwriteAsNeeded", "DoNotOverwrite" })]

        public System.Diagnostics.OverflowAction OverflowAction
        {
            get { return _overflowaction; }

            set
            {
                _overflowaction = value;
                _overflowSpecified = true;
            }
        }

        private System.Diagnostics.OverflowAction _overflowaction;
        private bool _overflowSpecified = false;
        /// <summary>
        /// Maximum size of this log.
        /// </summary>
        [Parameter]
        [ValidateNotNullOrEmpty]
        public Int64 MaximumSize
        {
            get { return _maximumKilobytes; }

            set
            {
                _maximumKilobytes = value;
                _maxkbSpecified = true;
            }
        }

        private Int64 _maximumKilobytes;
        private bool _maxkbSpecified = false;
        #endregion Parameters

        #region private
        private void WriteNonTerminatingError(Exception exception, string resourceId, string errorId,
      ErrorCategory category, string _logName, string _compName)
        {
            Exception ex = new Exception(StringUtil.Format(resourceId, _logName, _compName), exception);
            WriteError(new ErrorRecord(ex, errorId, category, null));
        }

        #endregion private

        #region Overrides

        /// <summary>
        /// Does the processing.
        /// </summary>
        protected override
        void
        BeginProcessing()
        {
            string computer = string.Empty;
            foreach (string compname in ComputerName)
            {
                if ((compname.Equals("localhost", StringComparison.OrdinalIgnoreCase)) || (compname.Equals(".", StringComparison.OrdinalIgnoreCase)))
                {
                    computer = "localhost";