Quantcast
Channel: .NET Framework Class Libraries forum
Viewing all articles
Browse latest Browse all 8156

EventLog.EntryWritten firing for events in the past

$
0
0

Hello - I have a windows service that will setup a delegate for the EntryWritten event. My understanding of this event handler is that it will only fire when an entry is written to the event log. However, events from the past that are contained in that eventlog (I'm talking events that occurred in some cases 2 years ago) that were previously written also cause the delegate to fire. For example today, 4/8/2015, I see events that occurred back in 2013 acting as though they were written today.

Is this behavior expected? It seems as thought it is a bug or possibly something I am not doing correctly in the code. Any light that can be shed on this situation would be great.


        private static bool SetupListeners()
        {
            var logsConfigurationSection = ConfigurationManager.GetSection("LogsSection") as LogsConfigurationSection;

            if (logsConfigurationSection == null) return false;

            for (var incr = 0; incr < logsConfigurationSection.Logs.Count; incr++)
            {
                List<EventLog> el;

                if (logsConfigurationSection.Logs[incr].Wildcard)
                    el = EventLog.GetEventLogs()
                        .Where(w => w.Log.ToLower().StartsWith(logsConfigurationSection.Logs[incr].Name.ToLower())).ToList();
                else
                    el = EventLog.GetEventLogs()
                        .Where(w => w.Log.ToLower().Equals(logsConfigurationSection.Logs[incr].Name.ToLower())).ToList();

                foreach (var eLog in el)
                {
                    Log.Information("Setting up EntryWritten listener for {0}. Configuration is name {1} and wildcard {2}",
                    eLog.Log, logsConfigurationSection.Logs[incr].Name, logsConfigurationSection.Logs[incr].Wildcard);

                    eLog.EntryWritten += OnEntryWritten;
                    eLog.EnableRaisingEvents = true;

                    ListeningLogs.Add(eLog);
                }
            }

            return true;
        }

EDIT 1: This is C# 5.0, .NET Framework 4.5 and the service runs on Windows Server 2008 and/or Windows Server 2012 (core and full).

EDIT 2: Looks like this situation has been present for some time given this post on SO:

http://stackoverflow.com/questions/19137560/eventlog-entrywritten-event-handles-events-from-the-past

As a stopgap in the code, I plan to interrogate EventLogEntry.TimeWritten (converted to UTC) relative to DateTime.UtcNow with a "buffer" of 2 minutes. This is inside of OnEntryWritten (the delegate called):

if (elEntry.TimeWritten.ToUniversalTime() < DateTime.UtcNow.AddMinutes(-_bufferMins))
                return;

Regards,
Ryan






Viewing all articles
Browse latest Browse all 8156

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>