Solved

[Vb.net] Eventlog Watcher Service becomes unresponsive after large amount of entries

Posted on 2013-01-07
6
692 Views
Last Modified: 2013-01-07
This is the situation:
I have written a Windows Service that monitors the Domain Controllers Security eventlog for certain events.
It filters the eventmessages and sends email if a filter is matched.

The service runs fine until our HR-->Active Directory import runs.
This adds ca. 2000 events to the Security eventlog within 2 seconds.
After this, the service still runs, but doesn't respond to new events anymore.
Hopefully someone can point me in the right direction to solve this

Imports System.Threading
Imports System.Net.Mail
Imports System.Security.Principal

Public Class EventLogWatcherService
    Private Shared signal As AutoResetEvent

    Protected Overrides Sub OnStart(ByVal args() As String)
        ' This is where the service starts 

        'Start the Event Log Watcher Service as a new thread
        Dim workerThread = New Thread(AddressOf WatchEventLog)
        workerThread.Start()

        'Write start message to Eventlog
        WriteLogMessage("Service Started", EventLogEntryType.Information)
    End Sub

    Public Sub WatchEventLog()
        'Set new event
        signal = New AutoResetEvent(False)

        'Connect to the OS-Security Eventlog
        Dim logwatcherlog = New EventLog("Security", ".", "LogMonitoringService")
        logwatcherlog.Source = "LogMonitoringService"

        'Add event handler to the Security Eventlog. This triggers at new events
        AddHandler logwatcherlog.EntryWritten, New System.Diagnostics.EntryWrittenEventHandler(AddressOf EventLog1_EntryWritten)
        logwatcherlog.EnableRaisingEvents = True

        'Wait for Event
        signal.WaitOne()
    End Sub

    Public Sub EventLog1_EntryWritten(ByVal [source] As Object, ByVal e As entryWrittenEventArgs)
        'Check the Events on EventID's. On match a new thread is fired to handle this event.
        If e.Entry.InstanceId = "4728" Or e.Entry.InstanceId = "4729" Then
            Dim thread As New Threading.Thread(AddressOf FoundEventToHandle)
            thread.Start(e)
        End If
    End Sub

    Public Sub FoundEventToHandle(ByVal e As EntryWrittenEventArgs)
            ‘Filters the eventmessage and sends an email on a filter match.

            '** WHEN HR-->AD IMPORT IS RUN, THIS PART ISN"T REACHED**
            
            'Dispose the current Entry to prevent unresponive service
            e.Entry.Dispose()

           'Sleep short and Signal for complete
           Thread.Sleep(1)
           signal.Set()
    End Sub

Open in new window

0
Comment
Question by:orbisict
  • 3
  • 3
6 Comments
 
LVL 83

Accepted Solution

by:
CodeCruiser earned 500 total points
Comment Utility
I think it happens because you try to create 2000 threads within 2 seconds which overwhelms it. What you can do is change the approach and use a queue with a single thread. Whenever a new entry is written, you put the EntryWrittenEventArgs into a queue. A single thread can then keep monitoring this queue and process the items when found.
0
 
LVL 1

Author Comment

by:orbisict
Comment Utility
Thanks @CodeCruiser, That was the solution !
I have it running already.

Just to be complete, here is part of the code that I changed:

In the Public Class, I added
Public EntryCollection As New Collection

Open in new window


in the Onstart I added a new thread to watch the eventlog queue
Dim EventCollectionWatcheTread = New Thread(AddressOf EventCollectionWatcher)
EventCollectionWatcheTread.start()
 

Open in new window


The Eventlog1 sub, where I handled the filter, now just looks like this:
Public Sub EventLog1_EntryWritten(ByVal [source] As Object, ByVal e As EntryWrittenEventArgs)
        'Add new entries to queue
        EntryCollection.Add(e)
        signal.Set()  
End Sub

Open in new window


The new Thread that watches the collection looks like this:
Public Sub EventCollectionWatcher()
       Do
            If EntryCollection.Count > 0 Then
                Dim e As EntryWrittenEventArgs = EntryCollection(1)
                If e.Entry.InstanceId = "4728" Or e.Entry.InstanceId = "4729" Then
                    Dim thread As New Threading.Thread(AddressOf FoundEventToHandle)
                    thread.Start(e)
                End If
                EntryCollection.Remove(1)
            End If
            Thread.Sleep(100)
        Loop
End Sub

Open in new window

0
 
LVL 1

Author Closing Comment

by:orbisict
Comment Utility
Exact description of the solution !
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 83

Expert Comment

by:CodeCruiser
Comment Utility
By the way, you are still creating extra threads in EventCollectionWatcher method which you don't need to as this method is already executing on a separate thread so you can put the code from FoundEventToHandle method in there.
0
 
LVL 1

Author Comment

by:orbisict
Comment Utility
Thanks CodeCruiser, I'm new to thread programming, therefore I really appreciate your assistance !
The 'FoundEventToHandle' sub is rather large and I'd like to leave it as a seperate sub.

Would it be ok to handle the event as shown below ?
Is it also correct to assume that I can delete the line  'Thread.Sleep(100)' too, because the code is now running as a single thread ?

Thanks !

Public Sub EventCollectionWatcher()
       Do
            If EntryCollection.Count > 0 Then
                Dim e As EntryWrittenEventArgs = EntryCollection(1)
                If e.Entry.InstanceId = "4728" Or e.Entry.InstanceId = "4729" Then
                       FoundEventToHandle()
                End If
                EntryCollection.Remove(1)
            End If
         Loop
End Sub

Open in new window

0
 
LVL 83

Expert Comment

by:CodeCruiser
Comment Utility
Yeah this should be fine.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

More often than not, we developers are confronted with a need: a need to make some kind of magic happen via code. Whether it is for a client, for the boss, or for our own personal projects, the need must be satisfied. Most of the time, the Framework…
The ECB site provides FX rates for major currencies since its inception in 1999 in the form of an XML feed. The files have the following format (reducted for brevity) (CODE) There are three files available HERE (http://www.ecb.europa.eu/stats/exch…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now