What happens if a new record is written to the event log when the application is inside the handler to record the previous record?

Question

My application needs to see all the application event log entries when they enter.

private void eventLog_Application_EntryWritten(object sender, EntryWrittenEventArgs e) { // Process e.Entry } 

What I would like to know is what happens if another record is written to EventLog while processing the previous record?

---

The documentation for EventLog.EntryWritten Event is an example of processing a record written in a record that uses streams (which is why I ask a question).

In this example, they use System.Threading and call the WaitOne() and Set() methods in the AutoResetEvent class, however I'm not sure exactly what this code is designed to achieve.

The documentation states that - WaitOne() "blocks the current thread until the current WaitHandle receives a signal," and that Set() "sets the event status for signaling, allowing one or more waiting threads to continue." I am not sure that part of the flow of this example is intended to be a demonstration, and how this relates to how (or if) it should be applied in practice.

It looks like WaitOne() blocks the stream immediately after recording the record until it is processed, where it will be set to an alarm (using Set() ) before allowing the stream to continue. Is this the only thread for the application?

Most importantly, when my application is not responsible for recording events that need to be read from EventLog, how should this principle be applied? (If, indeed, it needs to be applied.)

What happens if a new Entry written when the application is inside the handler?

Answer 1

Nothing dramatic happens; it is serialized by a wireframe. The main winapi function that fires the EventWritten event, NotifyChangeEventLog () .. The .NET Framework uses threadpool to monitor the event to receive a signal using ThreadPool.RegisterWaitForSingleObject (). You can see it being used here .

What is your hint why the MSDN sample uses ARE (AutoResetEvent). An event handler runs in this threadpool thread when this happens, unpredictably. The sample uses the console mode application, without this ARE it will immediately stop. Using ARE, it displays one notification and shuts down. This is actually not useful, I would just use Console.ReadLine () in the sample so that it continues to work and continues to display information until you press Enter.

You do not need this if you use a service or a graphical application that will work for a long time until the user explicitly closes it. Pay attention to the EventLog.SynchronizingObject property, which simplifies working with threadpool thread in a Winforms application.

Answer 2

The example does not help explain how AutoResetEvent works in a multi-threaded scenario, so I will try to explain how I understand its operation.

The static variable AutoResetEvent signal is created as a new AutoResetEvent parameter with the false or no signaling state set in it, which means that calling signal.WaitOne() will cause the thread that called WaitOne to wait while point until the signal variable is set by calling the signal.Set() method.

I found an AutoResetEvent explanation that describes it very well in understandable real-world conditions, which also includes this excellent example below. http://www.albahari.com/threading/part2.aspx#_AutoResetEvent

AutoResetEvent

AutoResetEvent is similar to a ticket turnstile: inserting a ticket allows exactly one person through. “Auto” in the class name refers to the fact that an open turnstile automatically closes or is “reset” after someone passes. The thread waits or blocks a WaitOne call on the turnstile (wait for this "one" turnstile before it opens) and the ticket is inserted by calling the Set method. If the number of threads is a WaitOne call, the turn is at the turnstile. (As is the case with locks, queue justice can sometimes be violated due to nuances in the operating system). A ticket can come from any stream; in other words, any (unlocked) thread with access to an AutoResetEvent object can call Set on it to release one blocked thread.

 class BasicWaitHandle { static EventWaitHandle _waitHandle = new AutoResetEvent (false); static void Main() { new Thread (Waiter).Start(); Thread.Sleep (1000); // Pause for a second... _waitHandle.Set(); // Wake up the Waiter. } static void Waiter() { Console.WriteLine ("Waiting..."); _waitHandle.WaitOne(); // Wait for notification Console.WriteLine ("Notified"); } } 

Answer 3

According to https://msdn.microsoft.com/en-us/library/0680sfkd.aspx eventlog components are not thread safe and this code exists to prevent unexpected behavior while interacting.

If several threads execute these lines at the same time, if it is possible for one thread to change the EventLog.Source Property of the event log, and for another thread to write a message, after this property has been changed.