none
Cannot read log entry number X. The event log may be corrupt. RRS feed

  • Question

  • I have subscribed to EventLog.EntryWritten event so that I can catch all events logged by different processes for a certain log name.

    Log = new EventLog(LogName);
    Log.EnableRaisingEvents = true;
    Log.EntryWritten += Log_EntryWritten;
    
    private void Log_EntryWritten(object sender, EntryWrittenEventArgs e)
    {
        try
        {
            var temporaryRecord = new MyDebugRecord(e.Entry);
            if (parser.IsValid(temporaryRecord))
            {
                PostRecords(temporaryRecord);
            }
        }
        catch(Exception ex)
        {
            Console.WriteLine(ex);
        }
     }

    From time to time there is an exception thrown, with following detalis and no call stack.

    System.InvalidOperationException occurred
    Message: Exception thrown: 'System.InvalidOperationException' in System.dll
    Additional information: Cannot read log entry number 4041508.  The event log may be corrupt.

    The problem is that after this exception is thrown my delegate begins to receive all logged events (older than few days), not just new ones (the ones received after subscribe moment). After few minutes, after all events has been delivered, the new ones start to appear. How can I avoid this behavior?


    • Edited by Tombec Monday, March 27, 2017 10:03 AM better description
    Monday, March 27, 2017 9:55 AM

All replies

  • Hi Tombec,

    Please try to clear the entries when encounter the exception and check if it works for you.

    Best regards,

    Cole Wu


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Tuesday, March 28, 2017 9:41 AM
    Moderator
  • Hi Cole Wu,

    Of course it works because there will be no old records to receive but only the new ones. However this is not a good solution for our clients, they rely on Windows Event Viewer for long periods of history.

    Another workaround is to filter within my application if an events has been received or not, based on its recorded timestamp. This has the drawback that after an exception is thrown there are few minutes until all old records are delivered (and filtered) and new ones start to come in again.

    None of those two solutions are ideal.

    Thanks, Tombec


    • Edited by Tombec Tuesday, March 28, 2017 11:36 AM
    Tuesday, March 28, 2017 11:29 AM
  • Hi Tombec,

    It seems that EventLog does not have a method to jump to special date or special records.

    Best regards,

    Cole Wu


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    Tuesday, April 4, 2017 3:13 AM
    Moderator