Retriving event logs faster vb.net

Hello,

Today i use below function:

 Dim entry As EventLogEntry
            Dim EL As New EventLog("Application", server, service)
  For Each entry In EL.Entries
 If entry.Source = service Then

That works and all but the log file is sometimes very big which makes this function take very long time, even when i have specified a source in EL's properties it seams to download everything, thats why the if statement.  Is there anyway i can filter the source, and maybe the time before i actually downloading all the logs? if not, any other way to optimize this code to make it faster?

Kind regards,
Peter Hillerberg
carnegieukAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Rahul Goel ITILSenior Consultant - DeloitteCommented:
If you're both on Vista or Windows Server 2008, you're in luck. You should look at the new System.Diagnostics.Eventing.Reader.EventLogQuery and System.Diagnostics.Eventing.Reader.EventLogReader. These are new in .net 3.5.

Basically, you can build a query in XML and ship it over
0
Rahul Goel ITILSenior Consultant - DeloitteCommented:
and you can use BackgroundWorker Thread with async results.
0
Dirk HaestProject managerCommented:
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
OWASP: Avoiding Hacker Tricks

Learn to build secure applications from the mindset of the hacker and avoid being exploited.

carnegieukAuthor Commented:
Thanks very much for such a quick reply, however we are still on 2003... :(

any other possible solution?
0
carnegieukAuthor Commented:
Thanks Dhaest,

I get an error when i run this:
Operation is not supported on this platform.

just wrote a shot test, but for some reason it's not working.

its netframework 3.5 (vb 2008 express)
the server i adress is 2003 sp2 i run it on a server 2003 sp2.

any ideas?

thanks!
Private Sub getmessages()
        
        Dim queryString As String = "*[System/Level=2]"  ' XPATH Query
 
        Dim session As EventLogSession = New EventLogSession(serverrc)
 
        ' Query the Application log on the remote computer.
        Dim query As EventLogQuery = New EventLogQuery( _
            "Application", PathType.LogName, queryString)
        query.Session = session
 
        Try
 
            Dim logReader As New EventLogReader(query)
 
            ' Display query results.
            DisplayEventAndLogInformation(logReader)
 
        Catch e As EventLogException
 
            MsgBox("Could not query the remote computer! " & e.Message)
            Return
        End Try
 
 
    End Sub
 
 
 
    Private Sub DisplayEventAndLogInformation(ByVal logReader As EventLogReader)
 
        Dim eventInstance As EventRecord = logReader.ReadEvent()
        While Not eventInstance Is Nothing
            ' Display event info
            MsgBox("-----------------------------------------------------")
            MsgBox("Event ID: {0}", eventInstance.Id)
            MsgBox("Publisher: {0}", eventInstance.ProviderName)
 
 
            Try
                MsgBox("Description: {0}", eventInstance.FormatDescription())
 
            Catch e As EventLogException
 
                ' The event description contains parameters, and no parameters were 
                ' passed to the FormatDescription method, so an exception is thrown.
 
            End Try
 
            eventInstance = logReader.ReadEvent()
 
            ' Cast the EventRecord object as an EventLogRecord object to 
            ' access the EventLogRecord class properties.
            Dim logRecord As EventLogRecord = CType(eventInstance, EventLogRecord)
            MsgBox("Container Event Log: {0}", logRecord.ContainerLog)
        End While
 
    End Sub
        Dim queryString As String = "*[System/Level=2]"  ' XPATH Query
 
        Dim session As EventLogSession = New EventLogSession(serverrc)
 
        ' Query the Application log on the remote computer.
        Dim query As EventLogQuery = New EventLogQuery( _
            "Application", PathType.LogName, queryString)
        query.Session = session
 
        Try
 
            Dim logReader As New EventLogReader(query)
 
            ' Display query results.
            DisplayEventAndLogInformation(logReader)
 
        Catch e As EventLogException
 
            MsgBox("Could not query the remote computer! " & e.Message)
            Return
        End Try
 
 
    End Sub
 
 
 
 
 
    Private Sub DisplayEventAndLogInformation(ByVal logReader As EventLogReader)
 
        Dim eventInstance As EventRecord = logReader.ReadEvent()
        While Not eventInstance Is Nothing
            ' Display event info
            MsgBox("-----------------------------------------------------")
            MsgBox("Event ID: {0}", eventInstance.Id)
            MsgBox("Publisher: {0}", eventInstance.ProviderName)
 
 
            Try
                MsgBox("Description: {0}", eventInstance.FormatDescription())
 
            Catch e As EventLogException
 
                ' The event description contains parameters, and no parameters were 
                ' passed to the FormatDescription method, so an exception is thrown.
 
            End Try
 
            eventInstance = logReader.ReadEvent()
 
            ' Cast the EventRecord object as an EventLogRecord object to 
            ' access the EventLogRecord class properties.
            Dim logRecord As EventLogRecord = CType(eventInstance, EventLogRecord)
            MsgBox("Container Event Log: {0}", logRecord.ContainerLog)
        End While
 
    End Sub

Open in new window

0
Dirk HaestProject managerCommented:
Where exactly do you get the error ?
0
carnegieukAuthor Commented:
Sorry dont remember where i got the problem exactly and i dont have the time to test this now. i have kinda solved it reading other logfile with same information. Thank you so much for your help.

0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
.NET Programming

From novice to tech pro — start learning today.