Analyzing the log

There are very many ways that you could analyze the log to create a report of server performance. For example, from the EventViewer you could save the log in CSV (Comma Separated Values) which is easy to read in to Excel and process. However writing a custom application to process the data is also easy with the help of the EventLog component. For example, to compute the time a specified server is available you first need to start a new Windows Forms project and place an instance of the EventViewer component on it. In this simple example all of the computation will be performed in the OnLoad event handler. We start off by defining all of the variables to hold the on and off times and the status of the server:

private void Form1_Load(object sender, 
                  EventArgs e)
{
  eventLog1.Log = "SiteStatus";
  DateTime OnTime=new DateTime(0);
  DateTime OffTime = new DateTime(0);
  TimeSpan TotalTime=new TimeSpan();
  Boolean On;
  Boolean StartOn=false;

Next we open the log

  eventLog1.Log = "SiteStatus";

Reading the log is just a matter of stepping through its Entries collection one entry at a time:

  foreach (EventLogEntry entry 
                   in eventLog1.Entries)
  {
    string[] data = entry.Message.
                       Split(',');
    string Address = data[0];
    string Status=data[1];
    string RoundTripTime = data[2];

As the message is comma delimited we can use the Spilt method to chop it up into Address, Status and RoundTripTime.

We now check to see if this is the server we need the statistics on – in your program TargetServer should be replaced by the URL or IP address of the server:

    if(Address==TargetServer)
    {
       On=(Status=="Success");

The variable On is now True if the server is connected and false otherwise.

There are now three possibilities to consider. This could be the first On entry we have encountered in which case we need to store the time it first came on:

      if(!StartOn & On)
      {
        StartOn=true;
        OnTime=entry.TimeGenerated;
      }

It could be the first Off entry we have encountered in which case we can calculate the time interval it has been on:

      if(StartOn & !On)
      {
        StartOn=false;
        OffTime=entry.TimeGenerated;
        TotalTime+=OffTime-OnTime;
      }

Notice the use of a TimeSpan object to store the total time.

The third situation is where multiple on or off entries are encountered in the sequence. To calculate the interval correctly we just need the first on time so we can ignore any subsequent on records. We also can ignore any subsequent off entries that follow the first one we have detected so this completes the analysis. The program doesn’t deal with final entries that signify that the scan has come to an end and it will give the wrong answer if the server never goes off – because then we just have an on time and no off time to subtract. Both of these are easy to fix by adding extra conditions.

You can see that analysing time and state based data isn’t as easy as it first appears and it makes the use of a spreadsheet for ad-hoc analysis seem very attractive!

To access the code for this project, once you have registered,  click on CodeBin.

<ASIN:1590594177>

<ASIN:1590594177>

<ASIN:1590599551>