search

c0shea / Seq.Client.EventLog

Writes Windows Event Log entries to Seq
MIT License
33 stars 13 forks source link

OnEntryWritten receives more than 12 hours old entries from Windows after watcher starts which in turn wastes lots of Seq disk/cpu #5

Open oleschri opened 1 year ago

oleschri commented 1 year ago

I experience the same problem as @MattMofDoom describes in his blog entry.

He has re-written the OnEntryWritten handler in his Seq.Client.WindowsLogins to accommodate for this by comparing events with the service start time.

Can we add the same behavior to Seq.Client.EventLog? Maybe with an option in .config to not interfere with existing setups.

MattMofDoom commented 1 year ago

Hey @oleschri , there's a dev build of a (basically rewritten) seq.client.eventlog available. On a plane at the moment but I know https://mattmofdoom.com/updating-seqclienteventlog-for-dynamic-properties-and-more/ has a link to the download. Note that this dev build has been tested and subsequently used in prod with excellent results. Hope that helps!

oleschri commented 1 year ago

@MattMofDoom Thank you! After turning some rocks I found your dev repo of Seq.Client.EventLog and forked it. Will work from there and maybe send you a pull request.

MattMofDoom commented 1 year ago

No worries! The rewrite is very configurable and will keep track of where it's at in case of service/server restart. It was fun to bash into shape so Seq could reliably get all those added properties from the event log, and it solved some major production operations headaches in the process 😁

MattMofDoom commented 1 year ago

@oleschri Thanks for the PR! I have updated the dependencies and uploaded a new dev build at https://github.com/MattMofDoom/Seq.Client.EventLog/releases/tag/v3.2.1

MattMofDoom commented 1 year ago

New build at https://github.com/MattMofDoom/Seq.Client.EventLog/releases/tag/v3.2.2 - updating Lurgle.Logging which has most current dependencies for target framework