[Vb.net] Eventlog Watcher Service becomes unresponsive after large amount of entries
This is the situation:
I have written a Windows Service that monitors the Domain Controllers Security eventlog for certain events.
It filters the eventmessages and sends email if a filter is matched.
The service runs fine until our HR-->Active Directory import runs.
This adds ca. 2000 events to the Security eventlog within 2 seconds.
After this, the service still runs, but doesn't respond to new events anymore.
Hopefully someone can point me in the right direction to solve this
Imports System.ThreadingImports System.Net.MailImports System.Security.PrincipalPublic Class EventLogWatcherService Private Shared signal As AutoResetEvent Protected Overrides Sub OnStart(ByVal args() As String) ' This is where the service starts 'Start the Event Log Watcher Service as a new thread Dim workerThread = New Thread(AddressOf WatchEventLog) workerThread.Start() 'Write start message to Eventlog WriteLogMessage("Service Started", EventLogEntryType.Information) End Sub Public Sub WatchEventLog() 'Set new event signal = New AutoResetEvent(False) 'Connect to the OS-Security Eventlog Dim logwatcherlog = New EventLog("Security", ".", "LogMonitoringService") logwatcherlog.Source = "LogMonitoringService" 'Add event handler to the Security Eventlog. This triggers at new events AddHandler logwatcherlog.EntryWritten, New System.Diagnostics.EntryWrittenEventHandler(AddressOf EventLog1_EntryWritten) logwatcherlog.EnableRaisingEvents = True 'Wait for Event signal.WaitOne() End Sub Public Sub EventLog1_EntryWritten(ByVal [source] As Object, ByVal e As entryWrittenEventArgs) 'Check the Events on EventID's. On match a new thread is fired to handle this event. If e.Entry.InstanceId = "4728" Or e.Entry.InstanceId = "4729" Then Dim thread As New Threading.Thread(AddressOf FoundEventToHandle) thread.Start(e) End If End Sub Public Sub FoundEventToHandle(ByVal e As EntryWrittenEventArgs) ‘Filters the eventmessage and sends an email on a filter match. '** WHEN HR-->AD IMPORT IS RUN, THIS PART ISN"T REACHED** 'Dispose the current Entry to prevent unresponive service e.Entry.Dispose() 'Sleep short and Signal for complete Thread.Sleep(1) signal.Set() End Sub
The Eventlog1 sub, where I handled the filter, now just looks like this:
Public Sub EventLog1_EntryWritten(ByVal [source] As Object, ByVal e As EntryWrittenEventArgs) 'Add new entries to queue EntryCollection.Add(e) signal.Set() End Sub
The new Thread that watches the collection looks like this:
Public Sub EventCollectionWatcher() Do If EntryCollection.Count > 0 Then Dim e As EntryWrittenEventArgs = EntryCollection(1) If e.Entry.InstanceId = "4728" Or e.Entry.InstanceId = "4729" Then Dim thread As New Threading.Thread(AddressOf FoundEventToHandle) thread.Start(e) End If EntryCollection.Remove(1) End If Thread.Sleep(100) LoopEnd Sub
By the way, you are still creating extra threads in EventCollectionWatcher method which you don't need to as this method is already executing on a separate thread so you can put the code from FoundEventToHandle method in there.
Thanks CodeCruiser, I'm new to thread programming, therefore I really appreciate your assistance !
The 'FoundEventToHandle' sub is rather large and I'd like to leave it as a seperate sub.
Would it be ok to handle the event as shown below ?
Is it also correct to assume that I can delete the line 'Thread.Sleep(100)' too, because the code is now running as a single thread ?
Thanks !
Public Sub EventCollectionWatcher() Do If EntryCollection.Count > 0 Then Dim e As EntryWrittenEventArgs = EntryCollection(1) If e.Entry.InstanceId = "4728" Or e.Entry.InstanceId = "4729" Then FoundEventToHandle() End If EntryCollection.Remove(1) End If LoopEnd Sub
I have it running already.
Just to be complete, here is part of the code that I changed:
In the Public Class, I added
Open in new window
in the Onstart I added a new thread to watch the eventlog queue
Open in new window
The Eventlog1 sub, where I handled the filter, now just looks like this:
Open in new window
The new Thread that watches the collection looks like this:
Open in new window