How to get new logs in an EventLogEntyCollection?
- by Massimo
I need to monitor security event logs on very busy domain controllers, which generates hundreds of them each minute.
I know how to use EventLog, EventLogEntry and EvenLogEntryCollection to open and read a server's event log, but an EvenLogEntryCollection can contain ~300.000 events, and it wraps around continuously (and very fast), so I can't rely on its index to find new entries.
So far, the only thing I was able to come up with is saving the timestamp of the last processed log entry and then iterate above the EventLogEntryCollection until I find an EventLogEntry which TimeGenerated properties is greater than the timestamp I saved; but it's terribly slow to iterate on ~300.000 entries to find the new ones.
How can I quickly find the new entries in an big event log?