Question

I’ve two processes A and B.

Process A keeps on writing EventLogEntry every 5 secs.

Process B should listen to EntryWritten event on the EventLog Object and ASAP should report on screen that an entry has been written.

How to create Process B. (exe) that should be running always until closed manually.

Pls see the following code snippet:

class Observer
{
    static void Main(string[] args)
    {
        EventLog log = new EventLog("logname", "MyMachine", "source");

        log.EntryWritten += new EntryWrittenEventHandler(log_EntryWritten);
        log.EnableRaisingEvents = true;

        // The thread shouldn't exit here but wait till the event is received
        // When received, should call the handler
        // and then again keep waiting for next event.
    }

    static void log_EntryWritten(object sender, EntryWrittenEventArgs e)
    {
        if (e.Entry.Source == "source")
        {
            Console.WriteLine("Message " + e.Entry.Message);
            Console.WriteLine("InstanceId " + e.Entry.InstanceId);
            Console.WriteLine("Source " + e.Entry.Source);
            Console.WriteLine("TimeWritten " + e.Entry.TimeWritten);

            Console.ReadLine();
            Console.WriteLine("\n");
        }
    }
}

How can it be done?

Thanks.

Answer 1

You should remove the call to Console.ReadLine in the log_EntryWritten handler. Otherwise you will block the handler.

To avoid that your program terminates immediately you have to add this code at the end of Main:

Console.ReadKey();

Your main thead will block until a key is pressed on the console. The thread used by the EventLog class to service the EventWritten event will be used to execute your handler every time a new event arrives. Except you have to study this quote from Event.EventWritten Event that has some information that about your 5 seconds requirement:

The system responds to WriteEntry only if the last write event occurred at least six seconds previously. This implies you will only receive one EntryWritten event notification within a six-second interval, even if more than one event log change occurs. If you insert a sufficiently long sleep interval (around 10 seconds) between calls to WriteEntry, you are less likely to miss an event. However, if write events occur more frequently, you might not recieve the event notification until the next interval. Typically, missed event notifications are not lost, but delayed.