Is there a built-in method to binary search through the entries in the .NET EventLog.Entries collection?

Question

I am developing a log parsing service that captures specific security events in the Windows Event Log. My initial thought was to use Microsoft's LogParser, but I am not looking for any functionality beyond selecting specific Instance/Event IDs already known in advance.

After some benchmarking, I found that iterating over the entire .NET EventLog.Entries collection was over 3 times faster at pulling data than querying Microsoft's LogParser.

Ultimately, the data to be pulled will be saved in a SQL Server database. Since the service will perform this duty daily, I wish to avoid duplicate entries, and I will need a way to find the next entry in the EventLog.Entries collection that is not already in the database. I can begin inserting to the database once I've found that initial entry.

I was just about to write a binary search to find this entry using the most recent DATETIME timestamp field from the database and comparing it to the TimeWritten property from an item in the EventLog.Entries collection. This I can do, but I am wondering if there is already a built-in method to perform this search?

Answer 1

I don't know about EventLogEntryCollection, but if you need a generic binary search algorithm, you can use the one implemented in PowerCollections library.

Answer 2

I ended up writing my own since I could not find a built-in implementation:

/// <summary>
/// Performs a binary search on a specified EventLogEntryCollection's
/// TimeWritten property
/// </summary>
/// <param name="entries">The collection to search</param>
/// <param name="value">The timestamp value being searched</param>
/// <param name="low">The lower-bound search index</param>
/// <param name="high">The upper-bound search index</param>
/// <returns>The index of a matching timestamp, or -1 if not found</returns>
private int BinarySearch(EventLogEntryCollection entries, DateTime value, int low, int high)
{
    if (high < low)
     return -1;
    int mid = low + ((high - low) / 2);
    if (entries[mid].TimeWritten > value)
     return BinarySearch(entries, value, low, mid - 1);
    else if (entries[mid].TimeWritten < value)
     return BinarySearch(entries, value, mid + 1, high);
    else
     return mid;
}