locked
EventLog.WriteEntry() doesn't capture milliseconds RRS feed

  • Question

  • I have been searching everywhere for an answer to this, so i was hoping someone could please help me.

    ok so the problem is that i am trying to write to the Windows event log, i have created an event source and log using something along the lines of the following code

    EventLog.WriteEntry("My Test App", "Logging something", EventLogEntryType.Information, 7036);

    now when i went into the windows event log i noticed something strange. 

    for a regular windows event we get the following XML representation 

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="16384">7036</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2012-10-31T09:30:04.325258200Z" />
    <EventRecordID>32611</EventRecordID>
    <Correlation />
    <Execution ProcessID="624" ThreadID="3420" />
    <Channel>System</Channel>
    <Computer>Tom-Laptop</Computer>
    <Security />
    </System>
    - <EventData>
    <Data Name="param1">Computer Browser</Data>
    <Data Name="param2">stopped</Data>
    <Binary>420072006F0077007300650072002F0031000000</Binary>
    </EventData>
    </Event>


    from this regular windows event log we can see the time it was created by <TimeCreated SystemTime="2012-10-31T09:30:04.325258200Z" />

    the problem i am having is when ever i log to the event log using the above piece of code i get something TimeCreated that is only accurate to the second, in other words i get something like
    <TimeCreated SystemTime="2012-10-31T09:30:04.000000000Z" />

    and for me this is unacceptable as i have events that can occur within 1 second of each other. i understand that the events will always be logged sequentially bu if i was to export and sort them in some other program this time stamp is no longer sufficient.

    Please if anyone has any idea why this is happening, any help would be greatly appreciated

    Wednesday, October 31, 2012 9:41 AM

Answers

  • Hi Tom,

    I get it. And also thanks Petro.

    I noticed that this millisecond only in the Security, setup and System event log.

    Any event in the Application event log doesn't contains millisecond. This should be by design.

    Have a nice day.


    Ghost,
    Call me ghost for short, Thanks
    To get the better answer, it should be a better question.

    • Proposed as answer by Mike Feng Monday, November 5, 2012 7:24 AM
    • Marked as answer by Mike Feng Thursday, November 8, 2012 3:34 PM
    Friday, November 2, 2012 8:43 AM

All replies

  • Hi Tom,

    Would you mind to tell us how to get the XML content?

    Have a nice day.


    Ghost,
    Call me ghost for short, Thanks
    To get the better answer, it should be a better question.

    Thursday, November 1, 2012 9:08 AM
  • You can save event in Xml format from event viewer:

     - Select event in the event viewer

     - In Context Menu choose "Save selected events..."

     - In "Save" dialog choose "Save as type" = xml


    Please remember to mark the replies as answers if they help

    Thursday, November 1, 2012 12:53 PM
  • In the event viewer you can right click an event, select event properties, click on the details tab, and you have the option of viewing it in XML format
    Friday, November 2, 2012 1:34 AM
  • Hi Tom,

    I get it. And also thanks Petro.

    I noticed that this millisecond only in the Security, setup and System event log.

    Any event in the Application event log doesn't contains millisecond. This should be by design.

    Have a nice day.


    Ghost,
    Call me ghost for short, Thanks
    To get the better answer, it should be a better question.

    • Proposed as answer by Mike Feng Monday, November 5, 2012 7:24 AM
    • Marked as answer by Mike Feng Thursday, November 8, 2012 3:34 PM
    Friday, November 2, 2012 8:43 AM
  • Hi Tom,

    Using .NET Reflector It looks that the real method to write the event log is inside advapi32.dll and the method called by .NET Framework does not send any DateTime object. Perhaps advapi32.dll writes the actual system time without milliseconds.

    Maybe is there another method in that dll that receives a DateTime object.

    Friday, November 2, 2012 1:51 PM
  • To get the millisecond times you may need to write to an ETW log. You can read more about it at http://social.msdn.microsoft.com/Forums/en-US/etw/thread/a1aa1350-41a0-4490-9ae3-9b4520aeb9d4. I'm having trouble finding documentation on how to have .Net code write to an ETW log that shows up in Event Viewer, but I know it's possible.
    Friday, November 2, 2012 5:24 PM