How to prevent loss of event retrieval while reading from event log?

Question

I'm using EventLogWatcher class (as it was suggested as the fastest available method to read from event log) to read newly written events. Let's say I have an event-log named CustomEventLog1 of size 2MB. I have an application to write a total of 20000 events to this log and have set Overwrite events as needed when the log reaches maximum size.

Now, as I start writing the events, the watcher obviously lags reading speed and events get lost.

Let me tell how it happens; when the application is writing say (1000th entry) , the watcher is still reading the 500th entry so when the watcher comes to read the 2000th entry , the writing application has already replaced it with the 4000th entry .

So after 1999th entry , I get 4000th entry . When the application completed writing 20000 events , the watcher only got 12020 entries and the remaining were lost.

Is there any way to work around this? I know increasing the log file size will just do it, but is there any way to achieve this without increasing the log size and without reducing the writing speed.

Answer 1

You want to do the Overwriting without increasing the log size and reducing the writing speed, And you also want to read the log which has been overwriting, You can't have both. But you can set logsize >= 20000 , and delete the event after it has been read, so that the log size will be saved to the greatest extent.