OnEntryWritten receives more than 12 hours old entries from Windows after watcher starts which in turn wastes lots of Seq disk/cpu

[oleschri]

I experience the same problem as @MattMofDoom describes in his blog entry.

He has re-written the OnEntryWritten handler in his Seq.Client.WindowsLogins to accommodate for this by comparing events with the service start time.

Can we add the same behavior to Seq.Client.EventLog? Maybe with an option in .config to not interfere with existing setups.

[MattMofDoom]

Hey @oleschri , there's a dev build of a (basically rewritten) seq.client.eventlog available. On a plane at the moment but I know https://mattmofdoom.com/updating-seqclienteventlog-for-dynamic-properties-and-more/ has a link to the download. Note that this dev build has been tested and subsequently used in prod with excellent results. Hope that helps!

[oleschri]

@MattMofDoom Thank you! After turning some rocks I found your dev repo of Seq.Client.EventLog and forked it. Will work from there and maybe send you a pull request.

[MattMofDoom]

No worries! The rewrite is very configurable and will keep track of where it's at in case of service/server restart. It was fun to bash into shape so Seq could reliably get all those added properties from the event log, and it solved some major production operations headaches in the process 😁

[MattMofDoom]

@oleschri Thanks for the PR! I have updated the dependencies and uploaded a new dev build at https://github.com/MattMofDoom/Seq.Client.EventLog/releases/tag/v3.2.1

[MattMofDoom]

New build at https://github.com/MattMofDoom/Seq.Client.EventLog/releases/tag/v3.2.2 - updating Lurgle.Logging which has most current dependencies for target framework