4

I'm trying to do application logging to the windows event log in c# with .net framework 4, but when I insert the log entries the TimeCreated field (Event viewer -> Windows Logs -> Application -> -> Details -> Friendly View -> System) gets a value like

[SystemTime] 2012-03-28T11:07:12.000000000Z 

As you see the sub-second accuracy is missing, although I can see some other event in the viewer where there are numbers also after the "." indicating a more precise timestamp.

Is this some kind of a limitation of the .Net Framework/CLR/C# or am I just doing things wrong?

Thanks.

VS2010SP1, Win7/Server 2008 R2 environment.

UPDATE:

I could mention I've tried with

EventLog.WriteEntry("applicationName", "message", logEntryType, (int)eventId, (short)taskCategory);

and log4net's EventLogAppender so far.

UPDATE 2:

So, using ETW for inserting events to the event log actually produces events where the SystemTime has a sub-second resolution. Could it be that this is actually necessary, feels like overkill for my case.

Jonas Granvik
  • 935
  • 7
  • 13

2 Answers2

2

Microsoft has finally provided a solution to this problem. Check out this blog post: Announcing the EventSource NuGet Package – Write to the Windows Event Log.

1

I can't find anything authoritative (unfortunately), but it appears that advapi32.dll's ReportEvent function only tracks down to the second. In the examples I've seen of using this function the time stamp is as you showed, just to the second.

The WriteEntry method uses ADVAPI32.dll ReportEvent function to write to the Event Log, no date/time values are passed into this function, so we must assume that it's an internal thing which does not track the precision.

Peter
  • 9,643
  • 6
  • 61
  • 108