slow reading of eventlog

[zorro]

I need to read the entire eventlog and parse it. The application uses vb.net and the EventLog object. The problem i'm having is that it can take less then a second up to 15 seconds to read all entries in the eventlog. I used Perfmon and found the following two counters that were used heavily

..NET CLR Security Total Runtime Check

..NET CLR Interop # of marshallin

I have written some sample code that shows my problem

Module Module
'<System.Security.SuppressUnmanagedCodeSecurity() >
Sub Main(
'Dim evl As New EventLog("System"
Dim evl As New EventLog("Application"

Dim str As Strin
Dim startTime, endTime As Dat

str = "No entries: " & evl.Entries.Coun
Debug.WriteLine(str
Console.WriteLine(str

For x As Integer = 0 To
startTime = No

For Each entry As EventLogEntry In evl.Entrie
str = entry.UserName & entry.Source & entry.MachineName &
entry.Category & entry.CategoryNumber & entry.EntryType &
entry.EventID & entry.Index & entry.TimeGenerated & entry.Messag
Nex

endTime = No

str = "Started: " & startTime.ToString("HH:mm:ss.ffff") & vbCrLf &
"Ended: " & endTime.ToString("HH:mm:ss.ffff"

Debug.WriteLine(str
Console.WriteLine(str
Nex
End Su
End Modul

When i run it on a P4 machine (3GHz and 2G ram) i get the following results
No entries: 170
Started: 12:04:34.875
Ended: 12:04:38.890

No entries: 193
Started: 12:05:37.937
Ended: 12:05:39.859

Since the application i'm writing is a graphical one i don't want any hangings

Any ideas how i can trim the system or change the code to make it run faster

[Ken Tucker [MVP]]

Hi,

Two suggestions.

1) This cuts the run time in half on my system. It is quicker to create a
new string than destroy and create a old one.

For Each entry As EventLogEntry In evl.Entries
Dim strEntry As String
strEntry = String.Format("{0} {1} {2} {3} {4} {5} {6} {7}
{8} {9}", entry.UserName, entry.Source, entry.MachineName, _
entry.Category, entry.CategoryNumber, entry.EntryType,
_
entry.EventID, entry.Index, entry.TimeGenerated,
entry.Message)
Next

No entries: 2055
Started: 06:44:13.2701
Ended: 06:44:16.7451

2) If you are worried about performance process the event log in a seperate
thread.

Ken
-----------------
"zorro" <an*******@discussions.microsoft.com> wrote in message
news:2F**********************************@microsof t.com...

I need to read the entire eventlog and parse it. The application uses
vb.net and the EventLog object. The problem i'm having is that it can take
less then a second up to 15 seconds to read all entries in the eventlog. I
used Perfmon and found the following two counters that were used heavily:

.NET CLR Security Total Runtime Checks

.NET CLR Interop # of marshalling

I have written some sample code that shows my problem:

Module Module1
'<System.Security.SuppressUnmanagedCodeSecurity() > _
Sub Main()
'Dim evl As New EventLog("System")
Dim evl As New EventLog("Application")

Dim str As String
Dim startTime, endTime As Date

str = "No entries: " & evl.Entries.Count
Debug.WriteLine(str)
Console.WriteLine(str)

For x As Integer = 0 To 0
startTime = Now

For Each entry As EventLogEntry In evl.Entries
str = entry.UserName & entry.Source & entry.MachineName & _
entry.Category & entry.CategoryNumber &
entry.EntryType & _
entry.EventID & entry.Index & entry.TimeGenerated &
entry.Message
Next

endTime = Now

str = "Started: " & startTime.ToString("HH:mm:ss.ffff") &
vbCrLf & _
"Ended: " & endTime.ToString("HH:mm:ss.ffff")

Debug.WriteLine(str)
Console.WriteLine(str)
Next
End Sub
End Module

When i run it on a P4 machine (3GHz and 2G ram) i get the following
results:
No entries: 1706
Started: 12:04:34.8750
Ended: 12:04:38.8906

No entries: 1933
Started: 12:05:37.9375
Ended: 12:05:39.8593

Since the application i'm writing is a graphical one i don't want any
hangings.

Any ideas how i can trim the system or change the code to make it run
faster.

[Cor Ligthert]

Hi Zorro,

As an alternative for Ken

For Each entry As EventLogEntry In evl.Entries
dim sb as new system.text.stringbuilder(entry.UserName)
sb.append(entry.Source)
sb.append(etc.)

do it really one by one so also
sb.append("Started: ")
sb.append(Startime.toString)

at the end
str = sb.toString

I am curious which one is the fastest?

Cor

[Herfried K. Wagner [MVP]]

* "=?Utf-8?B?em9ycm8=?=" <an*******@discussions.microsoft.com> scripsit:

For x As Integer = 0 To 0
startTime = Now

For Each entry As EventLogEntry In evl.Entries
str = entry.UserName & entry.Source & entry.MachineName & _
entry.Category & entry.CategoryNumber & entry.EntryType & _
entry.EventID & entry.Index & entry.TimeGenerated & entry.Message

Use a 'StringBuilder' instead of thousands of string concatenations.

--
Herfried K. Wagner [MVP]
<URL:http://dotnet.mvps.org/>

[Dominique Vandensteen]

wellwell
a post of me long time ago:

after the very small & vs string.format discussion I did some speed tests...
loop of 1.000.000 concatenations of 5 public string variables in a class
gave following results:
result = a & b & c & d & e
+/- 420ms

result = a
result &= b
result &= c
result &= d
result &= e
+/- 370ms

dim result as new StringBuilder()
result.Append(a)
result.Append(b)
result.Append(c)
result.Append(d)
result.Append(e)
new StringBuilder in each loop: +/- 730ms
new StringBuilder outside + result.length=0 in each loop: +/- 690ms

result = String.Format("{0}{1}{2}{3}{4}", a, b, c, d, e)
+/- 1540ms
so in my opinion, only use string.format to do real formatting :-)
the difference between the first 2 seems strange to me
is this a compiler problem?
oh yes, everything was ran in debug mode in visual studio 2003...
dominique

[Cor Ligthert]

Hi Dominique,

I tested it and the test is bellow.

With short strings I had almost the same results as you.
Although using the SB was the fastest while the concatanation of short
strings in line was almost the same.

What was also slightly different with me was that the creation of the SB
inside the loop the time was twice as much as with setting the length to 0,
(that test with new SB is not included).

However when the strings become longer, what is in the end of the test, I
had to bring the test down to 1000 loops when I did not wanted to wait to
long using something other than the stringbuilder.

Maybe you can have a look at it and when I did test something wrong tell me?

Cor

Module Teststrings
Public Sub main()
Dim arl As New ArrayList
arl.Add("This is string one")
arl.Add("This is string two")
arl.Add("This is string three")
arl.Add("This is string four")
arl.Add("This is string five")
arl.Add("This is string six")
arl.Add("This is string seven")
arl.Add("This is string eight")
arl.Add("This is string nine")
arl.Add("This is string ten")
Dim str As String
Dim start As Integer = Environment.TickCount
Dim sb As New System.Text.StringBuilder("")
For i As Integer = 0 To 100000
sb.Length = 0
sb.Append(arl(0).ToString)
sb.Append(arl(1).ToString)
sb.Append(arl(2).ToString)
sb.Append(arl(3).ToString)
sb.Append(arl(4).ToString)
sb.Append(arl(5).ToString)
sb.Append(arl(6).ToString)
sb.Append(arl(7).ToString)
sb.Append(arl(8).ToString)
sb.Append(arl(9).ToString)
Next
str = sb.ToString
MessageBox.Show("Short strings with stringbuilder: " & _
(Environment.TickCount - start).ToString)
start = Environment.TickCount
For i As Integer = 0 To 100000
str = arl(0).ToString & arl(1).ToString & arl(3).ToString _
& arl(4).ToString & arl(5).ToString & _
arl(6).ToString & arl(7).ToString & arl(8).ToString &
arl(9).ToString
Next
MessageBox.Show("Short strings with concat in row: " & _
(Environment.TickCount - start).ToString)
start = Environment.TickCount
For i As Integer = 0 To 100000
str = arl(0).ToString
str &= arl(1).ToString
str &= arl(2).ToString
str &= arl(3).ToString
str &= arl(4).ToString
str &= arl(5).ToString
str &= arl(6).ToString
str &= arl(7).ToString
str &= arl(8).ToString
str &= arl(9).ToString
Next
MessageBox.Show("Short strings with concat row by row: " _
& (Environment.TickCount - start).ToString)
start = Environment.TickCount
For i As Integer = 0 To 100000
str = str.Format("{0},{1},{2},{3},{4},{5},{6},{7},{8},{9 }",
arl(0).ToString, _
arl(1).ToString, arl(2).ToString, arl(3).ToString,
arl(4).ToString, arl(5).ToString, _
arl(6).ToString, arl(7).ToString, arl(8).ToString,
arl(9).ToString)
Next
MessageBox.Show("Short strings with format :" & _
(Environment.TickCount - start).ToString)
'Concetanation
start = Environment.TickCount
sb.Length = 0
For i As Integer = 0 To 1000
sb.Append(arl(0).ToString)
sb.Append(arl(1).ToString)
sb.Append(arl(2).ToString)
sb.Append(arl(3).ToString)
sb.Append(arl(4).ToString)
sb.Append(arl(5).ToString)
sb.Append(arl(6).ToString)
sb.Append(arl(7).ToString)
sb.Append(arl(8).ToString)
sb.Append(arl(9).ToString)
Next
str = sb.ToString
MessageBox.Show("Building a long string with sb : " & _
(Environment.TickCount - start).ToString)
str = ""
start = Environment.TickCount
For i As Integer = 0 To 1000
str &= arl(0).ToString & arl(1).ToString & _
arl(3).ToString & arl(4).ToString & arl(5).ToString & _
arl(6).ToString & arl(7).ToString & arl(8).ToString &
arl(9).ToString
Next
MessageBox.Show("Building a long string with concat in a row : " _
& (Environment.TickCount - start).ToString)
start = Environment.TickCount
str = ""
For i As Integer = 0 To 1000
str &= arl(0).ToString
str &= arl(1).ToString
str &= arl(2).ToString
str &= arl(3).ToString
str &= arl(4).ToString
str &= arl(5).ToString
str &= arl(6).ToString
str &= arl(7).ToString
str &= arl(8).ToString
str &= arl(9).ToString
Next
MessageBox.Show("Building a long string with concat : " _
& (Environment.TickCount - start).ToString)
start = Environment.TickCount
str = ""
For i As Integer = 0 To 1000
str &= str.Format("{0},{1},{2},{3},{4},{5},{6},{7},{8},{9 }", _
arl(0).ToString, arl(1).ToString, arl(2).ToString, _
arl(3).ToString, arl(4).ToString, arl(5).ToString, _
arl(6).ToString, arl(7).ToString, arl(8).ToString,
arl(9).ToString)
Next
MessageBox.Show("Building a long string with format : " _
& (Environment.TickCount - start).ToString)
End Sub
End Module