Is the event log (fast) enough for me?
In a recent project, I was required to come up with a suggestion for logging, and while the existing view of using a text file is used by many popular applications and is well understood, it felt like reinventing the wheel.
In the past, I’ve used great libraries like Enterprise Library or Log4Net to ensure I didn’t need to reinvent the wheel—but really only to ever write to a log file. I began to question whether I should use the Windows Event Log instead, since it offers many other features, especially around the viewer.
The viewer can not only provide a simple view but also offers sorting, filtering, exporting, remote connections (you can open the event logs on other machines), monitoring (through tools like System Center Operations Manager), and forwarding.
The big question for me has always been: Can it handle the load I want to throw at it? So to test this, I wrote a small application—available for download or feedback at Bitbucket—which spins up a few threads (on my machine, 4 is the magic number; above that, there’s no major improvement). It just writes as much data as quickly as possible to an event log.
Every time I’ve run it, I’ve managed to hit close to 40,000 writes per second! Monitoring CPU at the time, it averages between 30% to 50%—not a minor load, but understandable given the volume.
There isn’t much I have that needs that sort of speed, and if I do, there’s ETW. So help me chant: DEATH TO THE TEXT FILE, LONG LIVE THE EVENT LOG!