Question

I have an application reading some data from the event log, this application performance is too bad if the event log was too large, i.e. more than 30,000 entry.

I am searching for a faster way to get the info from it,

I have used for now two ways, using WMI the query was {Select message from Win32_NTLogEvent Where Logfile = ‘System’ and EventCode = ‘1’ }

I used System.Diagnostic.Eventlog.GetEventLogs(); which also takes too much time

What should I use to enhance the search speed?

Answer 1

This simple piece of code takes 4.6 seconds on 100,000 events on AMD Athlon X3 (i5 is more faster).

string queryString = "*";
int eventsCount = 0;
Stopwatch stopWatch = new Stopwatch();
stopWatch.Start();
EventLogQuery eventsQuery = new EventLogQuery("MyLog", PathType.LogName, queryString);
EventLogReader logReader = new EventLogReader(eventsQuery);

for (EventRecord eventInstance = logReader.ReadEvent();
                null != eventInstance; eventInstance = logReader.ReadEvent())
{
  if (eventInstance.Id == 100) //random event id                 
     ++eventsCount;

}
stopWatch.Stop();

Console.WriteLine("Found events: {0}", eventsCount);
Console.WriteLine("Time elapsed: {0}", stopWatch.Elapsed);

For better performance you can use a properly created XPATH Query, by your own or via windows eventviewer (create Custom view than choose XML tab)