以高性能方式查询 Windows 事件日志

发布于 2024-12-21 08:56:27 字数 838 浏览 1 评论 0原文

我构建了一个 ASP.NET Web 应用程序来使用数据绑定控件查看 Windows 事件日志中的数据。通过连接到访问 EventLog 的中介类的 ObjectDataSource 检索数据。当我将 GridView 连接到 ObjectDataSource 时，它想要计算 EventLog 中的行数。我可以简单快速地做到这一点：

var log = new EventLog {Log = logName};
return log.Entries.Count;

从我不科学的角度来看，它似乎在 O(1) 内返回。但是，如果我想对某个日期之前发生的条目或通过某个事件源发生的条目进行计数，我找不到有效的方法来对它们进行计数。我尝试过 WMI 查询，例如：

var query = new ObjectQuery("Select * from Win32_NTLogEvent
                             where LogFile='Application'");
var searcher = new ManagementObjectSearcher(query);
var result = searcher.Get();
var foo = result.Count;

对于具有 70k 条目的事件日志，在我的电源合理的工作站上，这大约需要一分钟的时间。看起来像 O(n)。我还尝试使用 Linq 过滤 log.Entries 并获得类似的结果。

有没有更高效的方法来做到这一点？对于网格中的实际数据，我发现循环 log.Entries 并通过索引访问是获取条目集合的一种非常高效的方法。

原文

I've built an ASP.NET web app to view data from the Windows Event Log using databound controls. The data is retrieved via an ObjectDataSource connected to a mediator class that accesses the EventLog. When I connect a GridView to the ObjectDataSource, it wants to count the rows in the EventLog. I can do this simply and quickly with:

var log = new EventLog {Log = logName};
return log.Entries.Count;

From my unscientific perspective, it appears to be returning in O(1). However, if I want to count entries that occur before a certain date or that are via a certain event source, I cannot find a way to count them that is efficient. I've tried WMI queries such as:

var query = new ObjectQuery("Select * from Win32_NTLogEvent
                             where LogFile='Application'");
var searcher = new ManagementObjectSearcher(query);
var result = searcher.Get();
var foo = result.Count;

For an event log with 70k entries, this takes on the order of a minute on my reasonably powered workstation. It's looking like O(n). I've also tried filtering log.Entries with Linq and get similar results.

Is there any more performant way to do this? For the actual data in the grid, I've found looping over the log.Entries and accessing via index a very performant way to get a collection of entries.

分享到QQ

分享到微博