How to get new logs in an EventLogEntyCollection?

Question

I need to monitor security event logs on very busy domain controllers, which generate hundreds of them each minute.

I know how to use EventLog, EventLogEntry and EvenLogEntryCollection to open and read a server's event log, but an EvenLogEntryCollection can contain ~300.000 events, and it wraps around continuously (and very fast), so I can't rely on its index to find new entries.

So far, the only thing I was able to come up with is saving the timestamp of the last processed log entry and then iterate above the EventLogEntryCollection until I find an EventLogEntry which TimeGenerated properties is greater than the timestamp I saved; but it's terribly slow to iterate on ~300.000 entries to find the new ones.

How can I quickly find the new entries in an big event log?

---

Edit:

I forgot to mention: I need to do this remotely, not on the DC itself...

Answer 1

You may consider using Windows Management Instrumentation. WMI Query Language (WQL) allows you to specify your constraints. ManagementEventWatcher allows you to respond to WMI events.

Look here for an example of the type of WQL query you need.

Here is how you code this:

WqlEventQuery wqlQuery = new WqlEventQuery(...);
ManagementEventWatcher watcher = new ManagementEventWatcher(wqlQuery);
watcher.EventArrived += new EventArrivedEventHandler(_Your_Event_Handler_);
watcher.Start();

// Do stuff.

watcher.Stop();