Reliably get Latest Event Log Record with WQL

Question

I have written an application which collects windows logs from linux, via the Zenoss wmi-client package.

It uses WQL to query the Event log and parses the return. My problem is trying to find the latest entry in the log.

I stumbled across this which tells me to use the NumberOfRecords column in a query such as this

Select NumberOfRecords from Win32_NTEventLogFile Where LogFileName = 'Application'

and use the return value from that as the highest log.

My question is, I have heard that the Windows Event log is a circular buffer, that is it overwrites it's oldest logs with new ones as the log gets full. Will this have an impact on NumberOfRecords, as if that happens, the "RecordNumber" property of the events will continue to increase, however the actual Number of Records in the event log wouldn't change (as for every entry written, one is dropped).

Can anyone shed some insight to how this actually works (whether NumberOfRecords is the highest RecordNumber, or the actual number of events in the log), and perhaps suggest a solution?

Update

So we know now that NumberOfRecords won't work on it's own because the Event Log is a ring buffer. The MS Solution is to get the Oldest record and add it to NumberOfRecords to get the actual latest record.

This is possible through WinAPI, but I am calling remotely from Linux. Does anyone know how I might achieve this in my scenario?

Thanks

Answer 1

NumberOfRecords will not always be the max record number because the log is circular and the log can be cleared and you may have 1 entry but it's record number is 1000.

The way you would do this using the win api would be to get the oldest record number and add the number of records in the log to get the max record number. It doesn't look like Win32_NTEventLogFile has a oldest record number field to use.

Are you trying to get the latest record every time you query the log? You can use TimeGenerated when you query Win32_NTLogEvent to get everything > NOW. You can iterate that list to find your max record number.

Answer 2

You need the RecordNumber of the newest record, but there is no fast way to get it. Generally, you have to:

SELECT RecordNumber FROM Win32_NTLogEvent WHERE LogFile='Application'

And find the max RecordNumber through results. But this can take tens of seconds or minutes if the size of log file is big...it's very slow.

But! You can get number of records:

SELECT NumberOfRecords FROM Win32_NTEventlogFile WHERE LogfileName='Application'

This is very fast. And then reduce the selection to speedup the search of the newest record:

SELECT RecordNumber FROM Win32_NTLogEvent WHERE LogFile='Application' AND RecordNumber>='_number_of_records_'

The execution time of this <= than in general case.