none
EntryWrittenEventHandler delivers large number of very old events RRS feed

  • Question

  • I have the following code which is using the "EntryWrittenEventHandler" class. It is running on thousands of machines very well. But in the last weeks I get a very strange behavior on more and more machines, where the EventHandler delivers a very large number of very old events recursively. The "if part" of the code is executed (marked with "Unwanted Block") very rapidly. It happens on W2K12 and W2K12 R2 servers with up-to-date Framework 4 versions and probably on other systems. I couldn't reproduce this problem in our test environment. What can I do to figure out the problem or to resolve it?

    For the same Problem please also see link http://stackoverflow.com/questions/16031610/strange-eventlog-behaviour-on-windows-server-2008-r2. There could be no answer found.

    EventLog _EventLog_Sec = new EventLog("Security");
    _EventLog_Sec.EntryWritten += new EntryWrittenEventHandler(OnEntryWritten_Sec);
    _EventLog_Sec.EnableRaisingEvents = true;

    public static void OnEntryWritten_Sec(object source, EntryWrittenEventArgs e)
    {
     try
     {
      //Damit keine alten Events gesendet werden
      if(e.Entry.TimeGenerated < DateTime.Now - TimeSpan.FromMinutes(5))
      {
                       ...//Unwanted Block !!!
      }
      ...
     }
            catch {}
    }

    Thursday, May 12, 2016 6:28 PM

Answers

  • I figured out, that the problem doesn’t exit, if the program is running with Framework 2 instead of 4. I have two W2K12 R2 machines, where this is the situation. So I assume that there is a problem in Framework 4 with class “EntryWrittenEventHandler“ or „EventLog”.

    @thsc007,

    If you suspect there is a problem in Framework 4, please also test on other machine to verify your guess.  If you have any discovery, please remember to post here. If necessary, you should report this issue to MS Connect.

    Now please help to close this case by marking helpful thread as an answer, thanks.

    Best regards,

    Kristin


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    • Marked as answer by thsc007 Thursday, May 19, 2016 2:21 PM
    Thursday, May 19, 2016 1:12 AM

All replies

  • Hi thsc007,

    >> I couldn't reproduce this problem in our test environment. What can I do to figure out the problem or to resolve it?

    It is important to reproduce your issue. If you cannot reproduce this issue on your side,  do you mean it happens by accident? If so, it is too hard for us to figure out this issue.

    >>The "if part" of the code is executed (marked with "Unwanted Block") very rapidly. It happens on W2K12 and W2K12 R2 servers with up-to-date Framework 4 versions and probably on other systems.

    Does it only related to winserver 2012? Other systems are working properly, right?

    Please also change to different .Net framework to test and check if there is something wrong with .Net framework.

    Best regards,

    Kristin


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    Friday, May 13, 2016 7:47 AM
  • At the moment the problem happens only on W2K12 and W2K12 R2 machines. Maybe other OS has the same issue.

    I asked my colleagues to switch to Framework 2 on all 3 machines in our focus now, so we will see the result (all this machines have Framework 2 installed). If I have new results I will inform you.

    I saw, that events are sometimes 2 days old. Sometimes old events are recursively send every 20 seconds. On one W2K12 R2 machine I saw a lot of events with EventID 0 and EntryType  0 and date of “1970-01-01T01:00:00+01:00”, but also events with EventID 4672, 4624, 4648, …

    Friday, May 13, 2016 6:44 PM
  • Hi thsc007,

    What's the problem now? Do you have any updates?

    >>I saw, that events are sometimes 2 days old. Sometimes old events are recursively send every 20 seconds. On one W2K12 R2 machine I saw a lot of events with EventID 0 and EntryType  0 and date of “1970-01-01T01:00:00+01:00”, but also events with EventID 4672, 4624, 4648, …

    It is weird. Please check your OS time is right. It also related to your OS time.

    Best regards,

    Kristin


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    Tuesday, May 17, 2016 8:56 AM
  • I figured out, that the problem doesn’t exit, if the program is running with Framework 2 instead of 4. I have two W2K12 R2 machines, where this is the situation. So I assume that there is a problem in Framework 4 with class “EntryWrittenEventHandler“ or „EventLog”.

    • Proposed as answer by Kristin Xie Thursday, May 19, 2016 1:07 AM
    Wednesday, May 18, 2016 4:50 PM
  • I figured out, that the problem doesn’t exit, if the program is running with Framework 2 instead of 4. I have two W2K12 R2 machines, where this is the situation. So I assume that there is a problem in Framework 4 with class “EntryWrittenEventHandler“ or „EventLog”.

    @thsc007,

    If you suspect there is a problem in Framework 4, please also test on other machine to verify your guess.  If you have any discovery, please remember to post here. If necessary, you should report this issue to MS Connect.

    Now please help to close this case by marking helpful thread as an answer, thanks.

    Best regards,

    Kristin


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    • Marked as answer by thsc007 Thursday, May 19, 2016 2:21 PM
    Thursday, May 19, 2016 1:12 AM