0

When more than one Windows Event Log is created within the same second, the sort/display order can be different than the order in which they were written. The index seems to be the reverse order in which they were written: LIFO, not FIFO.

I wrote code to read event log entries and both the TimeGenerated and TimeWritten are rounded to the nearest second. They do not have millisecond-resolution.

So, is there any way to get better resolution on Windows Event Log objects, for writing or reading? Maybe with a registry switch or code?

One solution to this would be to not use the Windows Event Log for data like this, and having higher-level events point to file logs with more detail. Another code solution would be to use the binary data field to store a timestamp in ticks. Then I can use a custom program to read/sort the log and use that data for finer resolution when it's available. But I'd prefer to avoid that hack which only applies to custom entries anyway.

I'm guessing a question will come up about "why do you care" or "that's not how the log should be used". Let's skip forward from that to specific technical answers. Thanks.

Improve this question
0

2 Answers 2

Reset to default
0

Negative the EVENT LOG RECORD only records to one second accuracy

Improve this answer
2
  • There isn't room in a 32 bit time stamp for a higher resolution. Changing this would break compatibility with applications that access the event log.
    – LMiller7
    Nov 5, 2017 at 4:56
  • Is not about the timestamp size, the readeventlog function returns an eventlogrecord object which is measured in seconds. You'd need a different read function to get additional info, if available
    – spacenomyous
    Nov 5, 2017 at 5:11
1

After researching, and as indicated in my Question, yes, there is a way to do this using the rawData byte[] stream : Just convert a timestamp (long or DateTime) into a byte array and save that.

No, we cannot use the default event log viewer to filter, sort, or view this. And no, we cannot sort by ms on log entries that we did not create, which was implied in the first part of my question, so I'm awarding the correct answer to @spacenonymous.

But the question is if we can sort the log, as in the data, not if we can use the default viewer - as I said in the OP:

Another code solution would be to use the binary data field to store a timestamp in ticks. Then I can use a custom program to read/sort the log and use that data for finer resolution when it's available.

So a more correct/refined answer is "yes, for entries we create, that's the way to do a sort/filter, but otherwise no".

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .