远程事件日志寻呼 [英] Remote Event Logs Paging

问题描述

我有以下要求

• 阅读远程机器的事件日志


• 传过来的凭证


• 允许通过此用户页面在MVC应用程序

从我的研究，我相信这可以通过使用<一个可以实现href=\"http://msdn.microsoft.com/en-us/library/system.diagnostics.eventing.reader.eventlogsession%28v=vs.110%29.aspx\"相对=nofollow> EventLogSession 可与<组合href=\"http://msdn.microsoft.com/en-us/library/system.diagnostics.eventing.reader.eventlogquery%28v=vs.110%29.aspx\"相对=nofollow> EventLogQuery ＆安培; <一href=\"http://msdn.microsoft.com/en-us/library/system.diagnostics.eventing.reader.eventlogreader%28v=vs.110%29.aspx\"相对=nofollow> EventLogReader 。

From my research I believe this can be achieved using the EventLogSession combined with the EventLogQuery & EventLogReader.

虽然我已经设法成功地conenct到远程计算机凭据和读取日志文件我卡与寻呼方面。我不知道该怎么办LINQ的跳过和放大器的同等学历;采取与EventLogQuery方法。

Whilst I've managed to successfully conenct to a remote machine with credentials and read the log files I'm stuck with the paging aspect. I don't know how to do the equivalent of LINQ's Skip & Take methods with the EventLogQuery.

有些机器将有> 20 000条日志，我想，以避免他们都加载到内存分页之前。

Some of these machines will have > 20 000 logs and I'd like to avoid loading them all into memory before paging.

有没有一种方法可以让我实现与EventLogQuery分页？

Is there a way I can achieve paging with the EventLogQuery?

推荐答案

下面是一个如何处理这一使用收益回报率懒惰评估能力的想法。给定一个查询中使用执行 EventLogQuery ，你可以做如下：

Here's an idea of how to approach this using the lazy evaluation capabilities of yield return. Given a query to execute using EventLogQuery, you can do as follows:

public IEnumerable<EventRecord> QueryEventRecords(string queryString)
{
    var query = new EventLogQuery("Application", PathType.LogName, queryString);
    using (var reader = new EventLogReader(query))
    {
        EventRecord eventRecord;
        while ((eventRecord = reader.ReadEvent()) != null)
        {
            yield return eventRecord;
        }
    }
}

然后您可以执行查询，然后用你喜欢的LINQ运营商对的IEnumerable 。

var result = QueryEventRecords("*[System[(Level = 3)]]")
    .Skip(10)
    .Take(10)
    .ToList();

这是说，寻呼远程PC不会在MVC应用程序飞 - 护屏分页之间的迭代器的有状态不会是可取的。可能是什么更好的将是$ P $从远程计算机对获取感兴趣的查询中的所有事件，而是这些保存到一个中央数据库（即类似的企业软件一样的 SCOM ）。您可以通过事件数据使用EF一样的ORM然后浏览在您的休闲。

That said, paging a remote PC isn't going to fly in an MVC application - retaining statefulness of the iterator between screen paging would not be advisable. What might better would be to pre-fetch all events in the query of interest from the remote machines and instead save these to a central database (i.e. similar to enterprise software like SCOM). You can then browse through the event data at your leisure using an ORM like EF.

这篇关于远程事件日志寻呼的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！