473,569 Members | 2,747 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

slow reading of eventlog

I need to read the entire eventlog and parse it. The application uses vb.net and the EventLog object. The problem i'm having is that it can take less then a second up to 15 seconds to read all entries in the eventlog. I used Perfmon and found the following two counters that were used heavily

..NET CLR Security Total Runtime Check

..NET CLR Interop # of marshallin

I have written some sample code that shows my problem

Module Module
'<System.Securi ty.SuppressUnma nagedCodeSecuri ty()>
Sub Main(
'Dim evl As New EventLog("Syste m"
Dim evl As New EventLog("Appli cation"

Dim str As Strin
Dim startTime, endTime As Dat

str = "No entries: " & evl.Entries.Cou n
Debug.WriteLine (str
Console.WriteLi ne(str

For x As Integer = 0 To
startTime = No

For Each entry As EventLogEntry In evl.Entrie
str = entry.UserName & entry.Source & entry.MachineNa me &
entry.Category & entry.CategoryN umber & entry.EntryType &
entry.EventID & entry.Index & entry.TimeGener ated & entry.Messag
Nex

endTime = No

str = "Started: " & startTime.ToStr ing("HH:mm:ss.f fff") & vbCrLf &
"Ended: " & endTime.ToStrin g("HH:mm:ss.fff f"

Debug.WriteLine (str
Console.WriteLi ne(str
Nex
End Su
End Modul

When i run it on a P4 machine (3GHz and 2G ram) i get the following results
No entries: 170
Started: 12:04:34.875
Ended: 12:04:38.890

No entries: 193
Started: 12:05:37.937
Ended: 12:05:39.859

Since the application i'm writing is a graphical one i don't want any hangings

Any ideas how i can trim the system or change the code to make it run faster
Nov 22 '05 #1
12 2332
Hi,

Two suggestions.

1) This cuts the run time in half on my system. It is quicker to create a
new string than destroy and create a old one.

For Each entry As EventLogEntry In evl.Entries
Dim strEntry As String
strEntry = String.Format(" {0} {1} {2} {3} {4} {5} {6} {7}
{8} {9}", entry.UserName, entry.Source, entry.MachineNa me, _
entry.Category, entry.CategoryN umber, entry.EntryType ,
_
entry.EventID, entry.Index, entry.TimeGener ated,
entry.Message)
Next

No entries: 2055
Started: 06:44:13.2701
Ended: 06:44:16.7451

2) If you are worried about performance process the event log in a seperate
thread.

Ken
-----------------
"zorro" <an*******@disc ussions.microso ft.com> wrote in message
news:2F******** *************** ***********@mic rosoft.com...
I need to read the entire eventlog and parse it. The application uses
vb.net and the EventLog object. The problem i'm having is that it can take
less then a second up to 15 seconds to read all entries in the eventlog. I
used Perfmon and found the following two counters that were used heavily:

.NET CLR Security Total Runtime Checks

.NET CLR Interop # of marshalling

I have written some sample code that shows my problem:

Module Module1
'<System.Securi ty.SuppressUnma nagedCodeSecuri ty()> _
Sub Main()
'Dim evl As New EventLog("Syste m")
Dim evl As New EventLog("Appli cation")

Dim str As String
Dim startTime, endTime As Date

str = "No entries: " & evl.Entries.Cou nt
Debug.WriteLine (str)
Console.WriteLi ne(str)

For x As Integer = 0 To 0
startTime = Now

For Each entry As EventLogEntry In evl.Entries
str = entry.UserName & entry.Source & entry.MachineNa me & _
entry.Category & entry.CategoryN umber &
entry.EntryType & _
entry.EventID & entry.Index & entry.TimeGener ated &
entry.Message
Next

endTime = Now

str = "Started: " & startTime.ToStr ing("HH:mm:ss.f fff") &
vbCrLf & _
"Ended: " & endTime.ToStrin g("HH:mm:ss.fff f")

Debug.WriteLine (str)
Console.WriteLi ne(str)
Next
End Sub
End Module

When i run it on a P4 machine (3GHz and 2G ram) i get the following
results:
No entries: 1706
Started: 12:04:34.8750
Ended: 12:04:38.8906

No entries: 1933
Started: 12:05:37.9375
Ended: 12:05:39.8593

Since the application i'm writing is a graphical one i don't want any
hangings.

Any ideas how i can trim the system or change the code to make it run
faster.

Nov 22 '05 #2
Hi,

Two suggestions.

1) This cuts the run time in half on my system. It is quicker to create a
new string than destroy and create a old one.

For Each entry As EventLogEntry In evl.Entries
Dim strEntry As String
strEntry = String.Format(" {0} {1} {2} {3} {4} {5} {6} {7}
{8} {9}", entry.UserName, entry.Source, entry.MachineNa me, _
entry.Category, entry.CategoryN umber, entry.EntryType ,
_
entry.EventID, entry.Index, entry.TimeGener ated,
entry.Message)
Next

No entries: 2055
Started: 06:44:13.2701
Ended: 06:44:16.7451

2) If you are worried about performance process the event log in a seperate
thread.

Ken
-----------------
"zorro" <an*******@disc ussions.microso ft.com> wrote in message
news:2F******** *************** ***********@mic rosoft.com...
I need to read the entire eventlog and parse it. The application uses
vb.net and the EventLog object. The problem i'm having is that it can take
less then a second up to 15 seconds to read all entries in the eventlog. I
used Perfmon and found the following two counters that were used heavily:

.NET CLR Security Total Runtime Checks

.NET CLR Interop # of marshalling

I have written some sample code that shows my problem:

Module Module1
'<System.Securi ty.SuppressUnma nagedCodeSecuri ty()> _
Sub Main()
'Dim evl As New EventLog("Syste m")
Dim evl As New EventLog("Appli cation")

Dim str As String
Dim startTime, endTime As Date

str = "No entries: " & evl.Entries.Cou nt
Debug.WriteLine (str)
Console.WriteLi ne(str)

For x As Integer = 0 To 0
startTime = Now

For Each entry As EventLogEntry In evl.Entries
str = entry.UserName & entry.Source & entry.MachineNa me & _
entry.Category & entry.CategoryN umber &
entry.EntryType & _
entry.EventID & entry.Index & entry.TimeGener ated &
entry.Message
Next

endTime = Now

str = "Started: " & startTime.ToStr ing("HH:mm:ss.f fff") &
vbCrLf & _
"Ended: " & endTime.ToStrin g("HH:mm:ss.fff f")

Debug.WriteLine (str)
Console.WriteLi ne(str)
Next
End Sub
End Module

When i run it on a P4 machine (3GHz and 2G ram) i get the following
results:
No entries: 1706
Started: 12:04:34.8750
Ended: 12:04:38.8906

No entries: 1933
Started: 12:05:37.9375
Ended: 12:05:39.8593

Since the application i'm writing is a graphical one i don't want any
hangings.

Any ideas how i can trim the system or change the code to make it run
faster.

Nov 22 '05 #3
Hi Zorro,

As an alternative for Ken

For Each entry As EventLogEntry In evl.Entries
dim sb as new system.text.str ingbuilder(entr y.UserName)
sb.append(entry .Source)
sb.append(etc.)

do it really one by one so also
sb.append("Star ted: ")
sb.append(Start ime.toString)

at the end
str = sb.toString

I am curious which one is the fastest?

Cor
Nov 22 '05 #4
Hi Zorro,

As an alternative for Ken

For Each entry As EventLogEntry In evl.Entries
dim sb as new system.text.str ingbuilder(entr y.UserName)
sb.append(entry .Source)
sb.append(etc.)

do it really one by one so also
sb.append("Star ted: ")
sb.append(Start ime.toString)

at the end
str = sb.toString

I am curious which one is the fastest?

Cor
Nov 22 '05 #5
Hi,

Two suggestions.

1) This cuts the run time in half on my system. It is quicker to create a
new string than destroy and create a old one.

For Each entry As EventLogEntry In evl.Entries
Dim strEntry As String
strEntry = String.Format(" {0} {1} {2} {3} {4} {5} {6} {7}
{8} {9}", entry.UserName, entry.Source, entry.MachineNa me, _
entry.Category, entry.CategoryN umber, entry.EntryType ,
_
entry.EventID, entry.Index, entry.TimeGener ated,
entry.Message)
Next

No entries: 2055
Started: 06:44:13.2701
Ended: 06:44:16.7451

2) If you are worried about performance process the event log in a seperate
thread.

Ken
-----------------
"zorro" <an*******@disc ussions.microso ft.com> wrote in message
news:2F******** *************** ***********@mic rosoft.com...
I need to read the entire eventlog and parse it. The application uses
vb.net and the EventLog object. The problem i'm having is that it can take
less then a second up to 15 seconds to read all entries in the eventlog. I
used Perfmon and found the following two counters that were used heavily:

.NET CLR Security Total Runtime Checks

.NET CLR Interop # of marshalling

I have written some sample code that shows my problem:

Module Module1
'<System.Securi ty.SuppressUnma nagedCodeSecuri ty()> _
Sub Main()
'Dim evl As New EventLog("Syste m")
Dim evl As New EventLog("Appli cation")

Dim str As String
Dim startTime, endTime As Date

str = "No entries: " & evl.Entries.Cou nt
Debug.WriteLine (str)
Console.WriteLi ne(str)

For x As Integer = 0 To 0
startTime = Now

For Each entry As EventLogEntry In evl.Entries
str = entry.UserName & entry.Source & entry.MachineNa me & _
entry.Category & entry.CategoryN umber &
entry.EntryType & _
entry.EventID & entry.Index & entry.TimeGener ated &
entry.Message
Next

endTime = Now

str = "Started: " & startTime.ToStr ing("HH:mm:ss.f fff") &
vbCrLf & _
"Ended: " & endTime.ToStrin g("HH:mm:ss.fff f")

Debug.WriteLine (str)
Console.WriteLi ne(str)
Next
End Sub
End Module

When i run it on a P4 machine (3GHz and 2G ram) i get the following
results:
No entries: 1706
Started: 12:04:34.8750
Ended: 12:04:38.8906

No entries: 1933
Started: 12:05:37.9375
Ended: 12:05:39.8593

Since the application i'm writing is a graphical one i don't want any
hangings.

Any ideas how i can trim the system or change the code to make it run
faster.

Nov 22 '05 #6
wellwell
a post of me long time ago:

after the very small & vs string.format discussion I did some speed tests...
loop of 1.000.000 concatenations of 5 public string variables in a class
gave following results:
result = a & b & c & d & e
+/- 420ms

result = a
result &= b
result &= c
result &= d
result &= e
+/- 370ms

dim result as new StringBuilder()
result.Append(a )
result.Append(b )
result.Append(c )
result.Append(d )
result.Append(e )
new StringBuilder in each loop: +/- 730ms
new StringBuilder outside + result.length=0 in each loop: +/- 690ms

result = String.Format(" {0}{1}{2}{3}{4} ", a, b, c, d, e)
+/- 1540ms
so in my opinion, only use string.format to do real formatting :-)
the difference between the first 2 seems strange to me
is this a compiler problem?
oh yes, everything was ran in debug mode in visual studio 2003...
dominique


Nov 22 '05 #7
wellwell
a post of me long time ago:

after the very small & vs string.format discussion I did some speed tests...
loop of 1.000.000 concatenations of 5 public string variables in a class
gave following results:
result = a & b & c & d & e
+/- 420ms

result = a
result &= b
result &= c
result &= d
result &= e
+/- 370ms

dim result as new StringBuilder()
result.Append(a )
result.Append(b )
result.Append(c )
result.Append(d )
result.Append(e )
new StringBuilder in each loop: +/- 730ms
new StringBuilder outside + result.length=0 in each loop: +/- 690ms

result = String.Format(" {0}{1}{2}{3}{4} ", a, b, c, d, e)
+/- 1540ms
so in my opinion, only use string.format to do real formatting :-)
the difference between the first 2 seems strange to me
is this a compiler problem?
oh yes, everything was ran in debug mode in visual studio 2003...
dominique


Nov 22 '05 #8
Hi Zorro,

As an alternative for Ken

For Each entry As EventLogEntry In evl.Entries
dim sb as new system.text.str ingbuilder(entr y.UserName)
sb.append(entry .Source)
sb.append(etc.)

do it really one by one so also
sb.append("Star ted: ")
sb.append(Start ime.toString)

at the end
str = sb.toString

I am curious which one is the fastest?

Cor
Nov 22 '05 #9
wellwell
a post of me long time ago:

after the very small & vs string.format discussion I did some speed tests...
loop of 1.000.000 concatenations of 5 public string variables in a class
gave following results:
result = a & b & c & d & e
+/- 420ms

result = a
result &= b
result &= c
result &= d
result &= e
+/- 370ms

dim result as new StringBuilder()
result.Append(a )
result.Append(b )
result.Append(c )
result.Append(d )
result.Append(e )
new StringBuilder in each loop: +/- 730ms
new StringBuilder outside + result.length=0 in each loop: +/- 690ms

result = String.Format(" {0}{1}{2}{3}{4} ", a, b, c, d, e)
+/- 1540ms
so in my opinion, only use string.format to do real formatting :-)
the difference between the first 2 seems strange to me
is this a compiler problem?
oh yes, everything was ran in debug mode in visual studio 2003...
dominique


Nov 22 '05 #10

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

1
2365
by: Sauron | last post by:
Hi all I have created a Service that will listen for incoming requests from client computers and communicate with my .NET remoting objects to send data back. My problem is when I start the Service. I call the RemotingConfiguration.Configure("appname.exe.config") method, but I get a System.IO.FileNotFoundException at that line. The file...
0
381
by: zorro | last post by:
I need to read the entire eventlog and parse it. The application uses vb.net and the EventLog object. The problem i'm having is that it can take less then a second up to 15 seconds to read all entries in the eventlog. I used Perfmon and found the following two counters that were used heavily ..NET CLR Security Total Runtime Check ..NET CLR...
3
477
by: | last post by:
I'm changing passwords every so often with my VB.net app using the NetUserSetInfo API call. I found that it is very slow, on a 3 GHz P4 it uses 18 seconds to change 100 passwords. Anyone else have the same experience ? I know for a fact that the code works. My VB.net code is as follows: Public Sub ChangePasswords() msgbox(now) Dim i As...
4
14681
by: Greg Smith | last post by:
I have an old application that analyzes the data in the event log on one of our servers. I would like to convert it to C#. Does anybody know of any examples of reading the event log on a remote system in C#. Any help is greatly appreciated.
0
1142
by: sangui | last post by:
..Net provide the class to read eventlog (EventLog class) but I try to read the window eventlog per file. without using EventLog Class. is it possible to read the log per file? public static void Main() { EventLog remoteEventLogs;
2
3536
by: Next | last post by:
Hello all, I have a windows service that was suppose to write some events into its own EventLog. I created the EventLog using the component on VS 2003 toolbar Added an installer for it. Set all the appropriate properties to assign the new Source to a new log. For some reason installutil.exe created the source in the correct log. But
3
5067
by: Ahmad Jalil Qarshi | last post by:
Hi! I am developing an application in C# as a windows NT Service. This application needs to check for eventlog using EventLog.Exists("System") But unfortunately it generates exception "Requested registry access is not allowed."
1
16735
by: hecsan07 | last post by:
Hey I am trying to read the Windows Event Logc. In fact, I am able to read the Event Log. My problem is that I am reading and filtering a large log and it takes a very very very very long time to complete. I am using the ordinary technique for reading/writing from and to the Event Log. I am wondering if there is a better way to speed things...
1
15971
by: martin | last post by:
Hi, I'm having some problems with the System.Diagnostics.EventLog class in .NET 2.0 I need to recreate an event message source inside a new log but the messages keeps ending up in the old log?! I have simplified my code into this tiny snippet: EventLog.CreateEventSource("mySrc", "myLog1");
3
4823
by: Ben | last post by:
I am trying to write an eventlog monitor. I am using the sample code provided by VB2005 SDK as the bases for my application. I need to monitor all three logs (application, system, and security). How can I monitor all three logs at once? Thanks,
0
7694
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main...
0
7921
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. ...
0
8118
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that...
0
7964
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the...
0
6278
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then...
0
5217
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert...
0
3651
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in...
0
3636
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
0
936
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.