0

I'm using LogParser COM API to query event logs in my WPF .NET 4.0 app, but now I'm facing a problem that the ExecuteQuery take too long to run. In the sample code which is Winform + .NET 2.0, the ExecuteQuery api of LogQueryClassClass return instantly. My parameters are the same with sample which is like below

var inputFormat = new COMEventLogInputContextClassClass
{
    direction = "FW",
    fullText = true,
    resolveSIDs = false,
    formatMessage = true,
    formatMsg = true,
    msgErrorMode = "MSG",
    fullEventCode = false,
    stringsSep = "|",
    iCheckpoint = string.Empty,
    binaryFormat = "HEX"
};

Now I'm just confused, since it does not make any sense for that API to behavior differently with Winform + .NET 2.0 and WPF + .NET 4.0. Can someone enlighten me here?

BTW, I'm using the same query, same parameter against remote server between the sample app and my app. So theoretically the performance should be the same, but now that usually ExecuteQuery takes about 5 secs in my app but in the sample app it returns immediately. With local machine event query though, the ExecuteQuery both return immediately in both apps.

My dev environment is Windows Server 2008 R2 + VS2010

imgen
  • 2,803
  • 7
  • 44
  • 64
  • How large is the event log you are trying to parse? Is it located on the same machine executing your code? Can you include the full error message you received? – Jay Walker Jan 25 '13 at 01:53
  • @JayWalker, The result is about 1000 items, it's against a remote server there is no error message though, both can execute successfully, just one is particularly slow. – imgen Jan 25 '13 at 01:55
  • @JayWalker, My OS is Windows Server 2008 R2 and I'm using VS2010 to compile both apps. – imgen Jan 25 '13 at 01:56
  • My guess is that there is something different between the sample app and your app or that there is something different between your local and your server. Difficult to tell w/o more information. I don't think the problem is specific to a version of the framework. Log Parser Lizard (http://www.lizard-labs.net/log_parser_lizard.aspx) is a tool that indicates Log Parser 2.2 and .net Framework 4.0 are prerequisites for it to work. – Jay Walker Jan 25 '13 at 03:06
  • Weird thing is that it is OK on my Windows 8 machine, both are very fast. So this is really weird. About my previous comment on local vs remote thing, actually on Windows Server 2008 R2, both local/remote takes a while for ExecuteQuery to return. But local will return in about 3s, while remote will return in about 5s. – imgen Jan 25 '13 at 03:10
  • And I'm using Log Parser Lizard as a comparison, I guess it may be is related to that I'm calling it in WPF app. – imgen Jan 25 '13 at 03:12
  • Will try a console app to verify that relative performance – imgen Jan 25 '13 at 03:12
  • Is your WPF app running under the same user account as in the "fast" scenario? The event log input format tries to load each DLL associated with the event log sources found in the log, and that might continuously fail when the current user does not have enough privileges. – Gabriele Giuseppini Mar 10 '13 at 09:31
  • @GabrieleGiuseppini, I guess they should. Does debug mode use different user account? I will try to verify this once I have time. Thx for the tip. – imgen Mar 11 '13 at 09:16

0 Answers0