I need to write an application to grab event log for System/Applications. The other requirement is that I need to read event log every minute or so to grab the new event logs since I read last time.
Currently I am considering to use C# to implement instead of C++.
With that I read several webpages and if I understand correctly, I can use either WMI or EventLog class to read event log.
It seems to me that I can be notified when the new event log is added using EventLog class but I was not sure that is better than using WMI.
If my understanding is correct, I would like to know which way I should take?
Please give me some advice. Thanks.
WMI is crap. It uses loads of memory and the “events” are achieved by polling internally. You can even set the poll interval. You are much better off to use the EventLog class of .NET. But if you need to read all logs from Windows Vista+ you must use the EventLogReader where you can read events which define the events not via a message dll file located under
but instead there is a ProviderGuid specified which is registered elsewhere. This makes it impossible to read many OS messages which use the new system. But you can use the EventLogReader class only on machines with an OS Version >= Vista. You will need two event log reader implementations depending on the installed OS if you need to get all messages.
The EventLog class can also be made quite speedy when you read the messages in chunks of e.g. 100 messages from up to 4 threads which does improve reading speed up to a factor 2-3. I did get random errors for the Security Event Log on Windows Server 2003 when reading from it from multiple threads but for the others it worked very well from XP 32 Bit up to Windows 7 x64.