缓慢阅读事件日志 [英] slow reading of eventlog
问题描述
我需要阅读整个事件日志并解析它。该应用程序使用vb.net和EventLog对象。我遇到的问题是，读取事件日志中的所有条目可能需要不到一秒钟甚至15秒。我使用Perfmon并发现以下两个重度使用的计数器
..NET CLR安全总运行时间检查
..NET CLR Interop #marshallin
我写了一些示例代码来说明我的问题
模块模块
''< ; System.Security.SuppressUnmanagedCodeSecurity（）>
Sub Main（
''Dim evl As New EventLog（" System"
Dim） evl作为新的EventLog（应用程序
Dim str As Strin
Dim startTime，endTime As Dat
str =" No entries："& evl.Entries.Coun
Debug.WriteLine（str
Console.WriteLine（str
for x As Integer = 0 To
startTime = No
For each entry as EventLogEntry in evl.Entrie
str = entry.UserName& entry.Source& entry.MachineName&
entry.Category& entry.CategoryNumber& entry.EntryTy pe&
entry.EventID& entry.Index& entry.TimeGenerated& entry.Messag
Nex
endTime =否
str ="已开始：" &安培; startTime.ToString（" HH：mm：ss.ffff"）& vbCrLf&
" Ended：" &安培; endTime.ToString（&HH：mm：ss.ffff"
Debug.WriteLine（str
Console.WriteLine（str
$ b） $ b Nex
结束Su
End Modul
当我在P4机器上运行它（3GHz和2G ram）时我得到以下结果
没有条目：170
开始于：12：04：34.875
结束时间：12：04：38.890
没有条目：193
开始时间：12：05：37.937
结束时间：12：05：39.859
由于我正在编写的应用程序是图形化的，我不想要任何挂钩
任何想法我如何修剪系统或更改代码来制作它跑得更快
两个建议。
1）这会将我的系统的运行时间缩短一半。创建一个比销毁更新的字符串更快，并创建一个旧字符串。
$ b每个条目的$ b作为EventLogEntry在evl.Entries中
Dim strEntry As Strin g
strEntry = String.Format（" {0} {1} {2} {3} {4} {5} {6} {7}
{ 8} {9}"，entry.UserName，entry.Source，entry.MachineName，_
entry.Category，entry.CategoryNumber，entry.EntryType，
_
entry.EventID，entry.Index，entry.TimeGenerated，
entry.Message）
Next
没有条目：2055
开始：06：44：13.2701
结束时间：06：44：16.7451
2 ）如果你担心性能过程，事件会单独登录
帖子。
肯
----- ------------
" zorro" <一个******* @ discussions.microsoft.com>在消息中写道
新闻：2F ********************************** @ microsof t.com ...我需要阅读整个事件日志并解析它。该应用程序使用
vb.net和EventLog对象。我遇到的问题是，读取事件日志中的所有条目可能需要不到一秒钟甚至15秒。我使用了Perfmon并发现以下两个被大量使用的计数器：
.NET CLR安全总运行时检查
.NET CLR Interop＃of marshalling
我写了一些示例代码来说明我的问题：
模块模块1
''< System.Security.SuppressUnmanagedCodeSecurity（）> _
Sub Main（）
''Dim evl As New EventLog（System）
Dim evl As New EventLog（Application）
Dim str as String
Dim startTime，endTime As Date
str =" No entries：" &安培; evl.Entries.Count
Debug.WriteLine（str）
Console.WriteLine（str）
对于x为整数= 0到0
startTime = Now
对于每个条目作为EventLogEntry在evl.Entries中
str = entry.UserName& entry.Source& entry.MachineName& _
entry.Category& entry.CategoryNumber&
entry.EntryType& _
entry.EventID& entry.Index& entry.TimeGenerated&
entry.Message
下一页
endTime =现在
str ="已开始：" &安培; startTime.ToString（" HH：mm：ss.ffff"）&
vbCrLf& _
结束： &安培; endTime.ToString（" HH：mm：ss.ffff"）
Debug.WriteLine（str）
Console.WriteLine（str）
下一页
End Sub
结束模块
当我在P4机器（3GHz和2G ram）上运行时，我得到以下
结果：
没有条目：1706
开始时间：12：04：34.8750
结束时间：12：04：38.8906
没有条目：1933
已发布：12：05：37.9375
结束时间：12：05 ：39.8593
由于我正在写的应用程序是一个图形的应用程序我不想要任何
挂起。
任何想法如何我可以修剪系统或更改代码使其运行更快。
两个建议。
1）这会将我的系统的运行时间缩短一半。创建一个
新字符串比销毁和创建旧字符串更快。
每个条目作为EventLogEntry在evl.Entries中
Dim strEntry As String
strEntry = String.Format（" {0} {1} {2} {3} {4} {5} {6} {7}
{8} {9}"，entry.UserName，entry.Source，entry.MachineName，_
entry.Category，entry.CategoryNumber，entry.EntryType，
_
entry.EventID，entry.Index，entry.TimeGenerated，
entry.Message）
下一页
没有条目：2055
开始：06：44：13.2701
结束时间：06：44：16.7451
2）如果你担心性能过程，事件会以单独的
线程登录。
Ken
-----------------
" zorro" <一个******* @ discussions.microsoft.com>在消息中写道
新闻：2F ********************************** @ microsof t.com ...我需要阅读整个事件日志并解析它。该应用程序使用
vb.net和EventLog对象。我遇到的问题是，读取事件日志中的所有条目可能需要不到一秒钟甚至15秒。我使用了Perfmon并发现以下两个被大量使用的计数器：
.NET CLR安全总运行时检查
.NET CLR Interop＃of marshalling
我写了一些示例代码来说明我的问题：
模块模块1
''< System.Security.SuppressUnmanagedCodeSecurity（）> _
Sub Main（）
''Dim evl As New EventLog（System）
Dim evl As New EventLog（Application）
Dim str as String
Dim startTime，endTime As Date
str =" No entries：" &安培; evl.Entries.Count
Debug.WriteLine（str）
Console.WriteLine（str）
对于x为整数= 0到0
startTime = Now
对于每个条目作为EventLogEntry在evl.Entries中
str = entry.UserName& entry.Source& entry.MachineName& _
entry.Category& entry.CategoryNumber&
entry.EntryType& _
entry.EventID& entry.Index& entry.TimeGenerated&
entry.Message
下一页
endTime =现在
str ="已开始：" &安培; startTime.ToString（" HH：mm：ss.ffff"）&
vbCrLf& _
结束： &安培; endTime.ToString（" HH：mm：ss.ffff"）
Debug.WriteLine（str）
Console.WriteLine（str）
下一页
End Sub
结束模块
当我在P4机器（3GHz和2G ram）上运行时，我得到以下
结果：
没有条目：1706
开始时间：12：04：34.8750
结束时间：12：04：38.8906
没有条目：1933
已发布：12：05：37.9375
结束时间：12：05 ：39.8593
由于我正在写的应用程序是一个图形的应用程序我不想要任何
挂起。
任何想法如何我可以修剪系统或更改代码使其运行更快。
嗨佐罗，
作为Ken的替代方案
For Each entry As EventLogEntry in evl.Entries
dim sb as new system.text.stringbuilder（entry.UserName ）
sb.append（entry.Source）
sb.append（等等）
真的一个一个地去做所以
sb.append（" Started："）
sb.append（Startime.toString）
结尾< br $>
str = sb.toString
我好奇哪一个最快？
Cor
I need to read the entire eventlog and parse it. The application uses vb.net and the EventLog object. The problem i''m having is that it can take less then a second up to 15 seconds to read all entries in the eventlog. I used Perfmon and found the following two counters that were used heavily
..NET CLR Security Total Runtime Check
..NET CLR Interop # of marshallin
I have written some sample code that shows my problem
Module Module
''<System.Security.SuppressUnmanagedCodeSecurity() >
Sub Main(
''Dim evl As New EventLog("System"
Dim evl As New EventLog("Application"
Dim str As Strin
Dim startTime, endTime As Dat
str = "No entries: " & evl.Entries.Coun
Debug.WriteLine(str
Console.WriteLine(str
For x As Integer = 0 To
startTime = No
For Each entry As EventLogEntry In evl.Entrie
str = entry.UserName & entry.Source & entry.MachineName &
entry.Category & entry.CategoryNumber & entry.EntryType &
entry.EventID & entry.Index & entry.TimeGenerated & entry.Messag
Nex
endTime = No
str = "Started: " & startTime.ToString("HH:mm:ss.ffff") & vbCrLf &
"Ended: " & endTime.ToString("HH:mm:ss.ffff"
Debug.WriteLine(str
Console.WriteLine(str
Nex
End Su
End Modul
When i run it on a P4 machine (3GHz and 2G ram) i get the following results
No entries: 170
Started: 12:04:34.875
Ended: 12:04:38.890
No entries: 193
Started: 12:05:37.937
Ended: 12:05:39.859
Since the application i''m writing is a graphical one i don''t want any hangings
Any ideas how i can trim the system or change the code to make it run faster
Hi,
Two suggestions.
1) This cuts the run time in half on my system. It is quicker to create a
new string than destroy and create a old one.
For Each entry As EventLogEntry In evl.Entries
Dim strEntry As String
strEntry = String.Format("{0} {1} {2} {3} {4} {5} {6} {7}
{8} {9}", entry.UserName, entry.Source, entry.MachineName, _
entry.Category, entry.CategoryNumber, entry.EntryType,
_
entry.EventID, entry.Index, entry.TimeGenerated,
entry.Message)
Next
No entries: 2055
Started: 06:44:13.2701
Ended: 06:44:16.7451
2) If you are worried about performance process the event log in a seperate
thread.
Ken
-----------------
"zorro" <an*******@discussions.microsoft.com> wrote in message
news:2F**********************************@microsof t.com...I need to read the entire eventlog and parse it. The application uses
vb.net and the EventLog object. The problem i''m having is that it can take
less then a second up to 15 seconds to read all entries in the eventlog. I
used Perfmon and found the following two counters that were used heavily:
.NET CLR Security Total Runtime Checks
.NET CLR Interop # of marshalling
I have written some sample code that shows my problem:
Module Module1
''<System.Security.SuppressUnmanagedCodeSecurity() > _
Sub Main()
''Dim evl As New EventLog("System")
Dim evl As New EventLog("Application")
Dim str As String
Dim startTime, endTime As Date
str = "No entries: " & evl.Entries.Count
Debug.WriteLine(str)
Console.WriteLine(str)
For x As Integer = 0 To 0
startTime = Now
For Each entry As EventLogEntry In evl.Entries
str = entry.UserName & entry.Source & entry.MachineName & _
entry.Category & entry.CategoryNumber &
entry.EntryType & _
entry.EventID & entry.Index & entry.TimeGenerated &
entry.Message
Next
endTime = Now
str = "Started: " & startTime.ToString("HH:mm:ss.ffff") &
vbCrLf & _
"Ended: " & endTime.ToString("HH:mm:ss.ffff")
Debug.WriteLine(str)
Console.WriteLine(str)
Next
End Sub
End Module
When i run it on a P4 machine (3GHz and 2G ram) i get the following
results:
No entries: 1706
Started: 12:04:34.8750
Ended: 12:04:38.8906
No entries: 1933
Started: 12:05:37.9375
Ended: 12:05:39.8593
Since the application i''m writing is a graphical one i don''t want any
hangings.
Any ideas how i can trim the system or change the code to make it run
faster.
Hi,
Two suggestions.
1) This cuts the run time in half on my system. It is quicker to create a
new string than destroy and create a old one.
For Each entry As EventLogEntry In evl.Entries
Dim strEntry As String
strEntry = String.Format("{0} {1} {2} {3} {4} {5} {6} {7}
{8} {9}", entry.UserName, entry.Source, entry.MachineName, _
entry.Category, entry.CategoryNumber, entry.EntryType,
_
entry.EventID, entry.Index, entry.TimeGenerated,
entry.Message)
Next
No entries: 2055
Started: 06:44:13.2701
Ended: 06:44:16.7451
2) If you are worried about performance process the event log in a seperate
thread.
Ken
-----------------
"zorro" <an*******@discussions.microsoft.com> wrote in message
news:2F**********************************@microsof t.com...I need to read the entire eventlog and parse it. The application uses
vb.net and the EventLog object. The problem i''m having is that it can take
less then a second up to 15 seconds to read all entries in the eventlog. I
used Perfmon and found the following two counters that were used heavily:
.NET CLR Security Total Runtime Checks
.NET CLR Interop # of marshalling
I have written some sample code that shows my problem:
Module Module1
''<System.Security.SuppressUnmanagedCodeSecurity() > _
Sub Main()
''Dim evl As New EventLog("System")
Dim evl As New EventLog("Application")
Dim str As String
Dim startTime, endTime As Date
str = "No entries: " & evl.Entries.Count
Debug.WriteLine(str)
Console.WriteLine(str)
For x As Integer = 0 To 0
startTime = Now
For Each entry As EventLogEntry In evl.Entries
str = entry.UserName & entry.Source & entry.MachineName & _
entry.Category & entry.CategoryNumber &
entry.EntryType & _
entry.EventID & entry.Index & entry.TimeGenerated &
entry.Message
Next
endTime = Now
str = "Started: " & startTime.ToString("HH:mm:ss.ffff") &
vbCrLf & _
"Ended: " & endTime.ToString("HH:mm:ss.ffff")
Debug.WriteLine(str)
Console.WriteLine(str)
Next
End Sub
End Module
When i run it on a P4 machine (3GHz and 2G ram) i get the following
results:
No entries: 1706
Started: 12:04:34.8750
Ended: 12:04:38.8906
No entries: 1933
Started: 12:05:37.9375
Ended: 12:05:39.8593
Since the application i''m writing is a graphical one i don''t want any
hangings.
Any ideas how i can trim the system or change the code to make it run
faster.
Hi Zorro,
As an alternative for Ken
For Each entry As EventLogEntry In evl.Entries
dim sb as new system.text.stringbuilder(entry.UserName)
sb.append(entry.Source)
sb.append(etc.)
do it really one by one so also
sb.append("Started: ")
sb.append(Startime.toString)
at the end
str = sb.toString
I am curious which one is the fastest?
Cor
这篇关于缓慢阅读事件日志的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
