Parallel Reading from Security Event Log fails on Windows XP 32 Bit

Parallel Reading from Security Event Log fails on Windows XP 32 Bit by Alois

Closed

as Not Reproducible Help for as Not Reproducible

Type:	Bug
ID:	410402
Opened:	2/2/2009 10:29:58 PM
Access Restriction:	Public

Workaround(s)

view

User(s) can reproduce this bug

When I read from Windows Event Log in parallel (to speed up reading) I get from the Security Event Log exceptions of the form:
Required Privilege not held and other stuff.

Details (expand)

English

Visual Studio 2008 SP1

Windows XP Professional

English

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Diagnostics;
using System.Threading;

namespace eventlogProblem
{
    class Program
    {

        public static void SecurityEventLogProblem()
        {
            while (true)
            {
                using (EventLog ev = new EventLog("Security"))
                {
                    // ev.Entries.Count throws this one:
                    /* InvalidOperationException: Cannot open log Security on machine .. Windows has not provided an error code.
                     at System.Diagnostics.EventLog.OpenForRead(String currentMachineName)
                     at System.Diagnostics.EventLog.get_EntryCount()
                     at System.Diagnostics.EventLogEntryCollection.get_Count()
                     at eventlogProblem.Program.SecurityEventLogProblem() in C:\Source\eventlogProblem\Program.cs:line 22
                     at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
                     at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
                     at System.Threading.ThreadHelper.ThreadStart()
                     *
                     // The other thread is at
                         [Managed to Native Transition]
                        System.dll!System.Diagnostics.EventLog.EntryCount.get() + 0x24 bytes
                        System.dll!System.Diagnostics.EventLog.GetEntryAtNoThrow(int index = 14518) + 0x21 bytes
                        System.dll!System.Diagnostics.EventLog.GetEntryAt(int index) + 0x11 bytes
                        System.dll!System.Diagnostics.EventLogEntryCollection.this[int].get(int index) + 0xc bytes
                     eventlogProblem.exe!eventlogProblem.Program.SecurityEventLogProblem() Line 36 + 0x16 bytes    C#
                    */

                    var count = ev.Entries.Count;

                    for (int i = (ev.Entries.Count - 1); i > (ev.Entries.Count - 100); i--)
                    {
                        // throws ArguemntException from time to time. It seems that the count changes
                        var entry = ev.Entries[i];
                    }
                }
            }
        }

        static void Main(string[] args)
        {
            for (int i = 0; i < 2; i++)
            {
                Thread t = new Thread(SecurityEventLogProblem);
                t.Start();
            }

            Console.WriteLine("Waiting for crash");
            Console.ReadLine();

        }
    }
}

Sporadic Exceptions.

No Exceptions when reading from Security Event Log.
On Windows Server 2008 this issue seems to be fixed although reading is much slower.

Hi Alois1,

I'm not able to reproduce the issue with reading from the Security log on the Windows XP. I've run the app you produced on my local XP machine for about a day and haven't run into the Exception.

With respect to the other issue you brought up where accessing the Entries array sometimes throws an ArgumentException it is possible for that to happen due to a race where the data in the event log can change between when you get the count parameter and when you index into the array. To work around this issue I'd recommend that you use the Enumerator on the EventLogEntriesCollection to get at entries. While this isn't as straight forward as the indexer the code paths there shouldn't throw (HasNext() would return false).

If you're able reproduce the issue where you get an InvalidOperationException please re-active this issue or shoot me an email and I'll try to work with you to get some more information to help me investigate what's going on here. My e-mail address is matell (at) microsoft (dot) com

Thanks again for contacting us. Hopefully this workaround works for you.

Cheers,
Matt Ellis
SDE, Base Class Libraries