A mystery IndexOutOfRange Exception recurring when reading from a full EventLog

问题

I'm maintaining an application which uses the Windows Application Event Log to 'scan' for errors from another application.

I need to find the first entry occurring since a specified time. So, what I've done so far is looped back from the latest Event Log entry (Entries.Count-1), until an entry is found before the specified time. The next entry must be the first one since this specified time, so I then loop forwards from this entry until the last one (Entries.Count-1).

However. I keep getting IndexOutOfRange Exceptions which I am finding difficult to resolve or understand.

Also, I have realised that some of my assumptions about the Event Log are very likely to be faulty - and I am struggling to find relevant documentation to correct myself.

The IndexOutOfRange Exception only occurs when the EventLog is full. Also, the log retention policy setting is set to 'Overwrite events as needed.'

Code

// This method is called every time a log is written to the Application Event Log
private void parseApplicationLogEntries()
{ 
    // Assumes the first log since the specified time is the most recent one
    int firstLog = log.Entries.Count-1;

    // Loops through the logs from the last one until the first,
    // stopping if it finds one before the specified time. 
    // The next entry must be the first one since the specified
    // time, so set the firstLog to its index and then break. 
    for (int entry = log.Entries.Count - 1; entry > 0; entry--)
    {
        DateTime logEntryTimeWritten = log.Entries[entry].TimeWritten;

        if (logEntryTimeWritten < specifiedTime)
        {
             firstLog = entry + 1;
             break;
        }
    }

    //
    for (int entry = firstLog; entry <= log.Entries.Count - 1; entry++)
    {
        string logSource = log.Entries[entry].Source; 

        if (logSource == sourceIAmLookingFor)
        {
            // Do some stuff
            // It's found, so break
        }
    }
}

So. There are plenty of doubtful assumptions here, and no Exception handling where there should obviously be some.

This makes the assumption that the Event Log indexes are ordered from oldest to newest entry, by time. (e.g. Entries[0] is the oldest entry, and Entries[Entries.Count-1] is the newest entry)
There is no Exception Handling to catch the IndexOutOfRange Exception.

Work towards a solution so far

Researched the EventLog on MSDN and elsewhere.
Written a program to flood the Event Log with entries in an attempt to replicate the conditions under which the Exception is occurring. (I cannot get the issue to recur under a development environment, even though it recurs frequently in a live environment.)

I am honestly at a complete loss. I can think of some 'half-fixes' (e.g. make the Event Log's maximum size huge, and stick in an Exception handler which just does nothing) - but what I really want is to understand why this is happening and fix it properly. Since the index should always be between 0 and Entries.Count-1 I don't have a clue.

Any thoughts?

回答1:

There is no need to access the EventLog in this way to review the newest entries.

Instead of calling a method to iterate through the EventLog each time a new Entry is written, it is simpler (and safer) to access the Entry more directly using the event handler which triggers each time an Entry is written.

private void eventLog_Application_EntryWritten(object sender, EntryWrittenEventArgs e)
{
    // Process e.Entry    
}

来源：https://stackoverflow.com/questions/29430071/a-mystery-indexoutofrange-exception-recurring-when-reading-from-a-full-eventlog

标签

event-log