none
Reading windows event logs using System.Diagnostics.EventLog RRS feed

  • Question

  • Hi,

    I have bunch of applications deployed on a windows server. In that one of the application writes lot of events to windows application event log file at the same time an another application reads the same windows application event logs .

    I am reading the logs using System.Diagnostics class , at many occurrences error is thrown and some time reads without any error.

     Exception caught:    at System.Diagnostics.EventLog.get_EntryCount()

       at System.Diagnostics.EventLogEntryCollection.get_Count() The interface is unknown.

    Application is built on .NET 2.0 . Please let me know how to resolve this issue.

    Thanks & Regards,

    Ellaiyaraja.B




    Thanks & Regards, Ellaiyaraja B

    Wednesday, March 9, 2016 10:04 AM

Answers

  • Also if I can again recommend as in my first post, what was next time probably true:

    the Count property can change during the lifetime of the EventLogEntryCollection instance that you create. It is usually best to work with the Count property directly instead of assigning its value to a variable.

    And your code is this:

    int last = eventLog[0].Entries.Entries.Count ;

    Regards...

    Duris_I

    • Proposed as answer by Duris_I Wednesday, March 16, 2016 7:16 PM
    • Marked as answer by DotNet WangModerator Monday, March 21, 2016 3:26 AM
    Thursday, March 10, 2016 12:11 PM

All replies

  • Hello,

    problem can be explained in this remark:

    An EventLogEntryCollection represents a dynamic list of all the entries in a log. Therefore, the Count property can change during the lifetime of the EventLogEntryCollection instance that you create. It is usually best to work with the Count property directly instead of assigning its value to a variable.

    So question is if you use direct access or via some variable, if so.

    Regards...

    Duris_I

    Wednesday, March 9, 2016 10:25 AM
  • Hi Duris_I,

    Thanks for your answer.

    I am aware of that the EventLogEntryCollection is dynamically changing. I don't have any issue if the collection is changed or not. The issue is it is throwing exception while accessing the collection object .

    How to avoid getting exception while accessing EventLogEntryCollection ? 

    <<

    Exception caught:    at System.Diagnostics.EventLog.get_EntryCount()   at System.Diagnostics.EventLogEntryCollection.get_Count() The interface is unknown.

    >>


    Thanks & Regards, Ellaiyaraja B

    Wednesday, March 9, 2016 11:56 AM
  • Hello,

    this I expect. There can be so much problems, but maybe one can be depended to iterate, check right index, simply right count of entries. All depends to your code.

          // Display the 'Message' property of EventLogEntry.
          for ( int i = 0; i < myEventLogEntryCollection->Count; i++ )
          {
             Console::WriteLine( "The Message of the EventLog is : {0}", myEventLogEntryCollection[ i ]->Message );
          }

    This is only example for right count of entries f.ex. If you can, post some piece of code to look.

    Update: this is C++

    Regards...

    Duris_I


    • Edited by Duris_I Wednesday, March 9, 2016 12:32 PM
    Wednesday, March 9, 2016 12:30 PM
  • Hi,

    I think still you did not get my exact issue. 

    The issue is ,

    code in c#

    // Below line gets all system event logs

    EventLog[]  eventLog = EventLog.GetEventLogs();

    // Assume where eventLog[0] is Application event log , This can be Security or System.

     int last = eventLog[0].Entries.Entries.Count ;

    The above line itself throws error ( getting the count value), but not all time .  

    [ I believe , since the object is being updated by another application at this same time. ]


    Thanks & Regards, Ellaiyaraja B

    Wednesday, March 9, 2016 12:46 PM
  • hmmm, another question is, if you have some data in that array eventLog[] when some application want read or write to it :) So better will be test that array for existing entries.

    Regards...

    Duris_I

    Wednesday, March 9, 2016 2:02 PM
  • Hi,

    This above line of code is running always in a while loop . the error is thrown some time.



    Thanks & Regards, Ellaiyaraja B

    Wednesday, March 9, 2016 2:30 PM
  • Hi Ellaiyaraja,

    >>I am reading the logs using System.Diagnostics class , at many occurrences error is thrown and some time reads without any error.

     Exception caught:    at System.Diagnostics.EventLog.get_EntryCount()

       at System.Diagnostics.EventLogEntryCollection.get_Count() The interface is unknown.

    Application is built on .NET 2.0 . Please let me know how to resolve this issue.

    I would suggest you provide a simplified demo to OneDrive, please remember to make a detailed repro steps. It could be better to help us understand your issue. Thanks.

    From my personal, I suspect this is a bug.

    Here I found a bug in Connect:After registering EventLog.EntryWritten event application crashes- by Alois please also make a check. And its status is still active.

    A similar thing has been reporter here as well:
    https://social.msdn.microsoft.com/Forums/vstudio/en-US/ae1b9476-4db0-4f66-a0a5-f5ebee467efc/exception-in-systemdiagnosticseventloggetentrycount?forum=netfxbcl

    Best regards,

    Kristin


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.


    • Edited by Kristin Xie Thursday, March 10, 2016 6:20 AM
    Thursday, March 10, 2016 6:18 AM
  • Hello,

    think about one important thing, Security LOG is read-only :) so hope you didn't write to it.

    Update: look at this important thing, like as I said in previous post, from MSDN:

    The array of EventLog objects is a snapshot of all event logs on the local computer when the call to GetEventLogs is made. This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. You should verify that a log in the array exists before you read or write to it.

    Update2: prepared my .NET example and discovered that problem probably, you've defined this:

     int last = eventLog[0].Entries.Entries.Count ;

    But in my first collect of Logs there isn't simple Entries.Entries.Count, this crash due not existed second nesting Entries Property! That second Entries is in my situation in

    eventLog[0].Entries.log.Entries.Count;

    So in some cases as I said before, check if you have that entries in your array.

    Regards...

    Duris_I



    • Edited by Duris_I Thursday, March 10, 2016 9:33 AM
    Thursday, March 10, 2016 8:52 AM
  • Also if I can again recommend as in my first post, what was next time probably true:

    the Count property can change during the lifetime of the EventLogEntryCollection instance that you create. It is usually best to work with the Count property directly instead of assigning its value to a variable.

    And your code is this:

    int last = eventLog[0].Entries.Entries.Count ;

    Regards...

    Duris_I

    • Proposed as answer by Duris_I Wednesday, March 16, 2016 7:16 PM
    • Marked as answer by DotNet WangModerator Monday, March 21, 2016 3:26 AM
    Thursday, March 10, 2016 12:11 PM
  • Hello Ellaiyaraja,

    How about the problem now? Do you have any updates about our suggestion?

    Please remember to close this thread by marking helpful reply as an answer. If you have any other questions, please feel free to reopen a new thread in this forum. Thanks for your understanding.

    Best regards,

    Kristin


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    Wednesday, March 16, 2016 2:03 AM