3

By way of background I am trying to consolidate windows security event log entries from a number of machines into a single SQL Table so I can report on them. This all works in C#.

But I need a way to more efficiently determine if I have seen this event before so I don't have to do a complex lookup on my database to see if I have seen every entry before.

Because multiple events can be generated at once, the only way I have seen so far to avoid duplicates is to check for the Event ID, Time Generated, Machine Name and in some cases parameters.

Does the .Net Framework expose any form of unique identifier I could use to simplify this process?

Thanks in advance

chrismor
  • 81
  • 5

3 Answers3

1

I'm not sure what C# method you're using, but you can get the record number which you could use (e.g. computer + log + record_number). I know you can get to the record number in C# via the ManagementObjectSearcher (aka WMI), not sure about the other APIs.

You can also get to the record number via the win32 APIs:

Old API: EVENTLOGRECORD Structure

New API: EventRecordID (SystemPropertiesType) Element

John Saunders
  • 160,644
  • 26
  • 247
  • 397
Mitch
  • 659
  • 1
  • 7
  • 18
  • ev = new EventLog(strLogType, strServerName); for (nIndex = nEntries - 1; nIndex != 0; nIndex--) { ee = ev.Entries[nIndex]; } – chrismor Aug 24 '11 at 01:25
1

OK, solved it with all your help. Take the Timestamp, Event ID and Machine Name, then create an MD5 Hash of that. Simple and easily indexed. Performance is up a long way too.

chrismor
  • 81
  • 5
0

Unfortunately the only thing you can do is take a combined key of the computer, event source, event id and timestamp for uniquely matching. There is no globally unique ID in the event framework, AFAIK.

John Oxley
  • 14,698
  • 18
  • 53
  • 78