EventLog.EntryWritten firing for events in the past

Question

Hello - I have a windows service that will setup a delegate for the EntryWritten event. My understanding of this event handler is that it will only fire when an entry is written to the event log. However, events from the past that are contained in that eventlog
(I'm talking events that occurred in some cases 2 years ago) that were previously written also cause the delegate to fire. For example today, 4/8/2015, I see events that occurred back in 2013 acting as though they were written today.
Is this behavior expected? It seems as thought it is a bug or possibly something I am not doing correctly in the code. Any light that can be shed on this situation would be great.
private static bool SetupListeners()
var logsConfigurationSection = ConfigurationManager.GetSection("LogsSection") as LogsConfigurationSection;
if (logsConfigurationSection == null) return false;
for (var incr = 0; incr < logsConfigurationSection.Logs.Count; incr++)
List<EventLog> el;
if (logsConfigurationSection.Logs[incr].Wildcard)
el = EventLog.GetEventLogs()
.Where(w => w.Log.ToLower().StartsWith(logsConfigurationSection.Logs[incr].Name.ToLower())).ToList();
else
el = EventLog.GetEventLogs()
.Where(w => w.Log.ToLower().Equals(logsConfigurationSection.Logs[incr].Name.ToLower())).ToList();
foreach (var eLog in el)
Log.Information("Setting up EntryWritten listener for {0}. Configuration is name {1} and wildcard {2}",
eLog.Log, logsConfigurationSection.Logs[incr].Name, logsConfigurationSection.Logs[incr].Wildcard);
eLog.EntryWritten += OnEntryWritten;
eLog.EnableRaisingEvents = true;
ListeningLogs.Add(eLog);
return true;
EDIT 1: This is C# 5.0, .NET Framework 4.5 and the service runs on Windows Server 2008 and/or Windows Server 2012 (core and full).
EDIT 2: Looks like this situation has been present for some time given this post on SO:
http://stackoverflow.com/questions/19137560/eventlog-entrywritten-event-handles-events-from-the-past
As a stopgap in the code, I plan to interrogate EventLogEntry.TimeWritten (converted to UTC) relative to DateTime.UtcNow with a "buffer" of 2 minutes. This is inside of OnEntryWritten (the delegate called):
if (elEntry.TimeWritten.ToUniversalTime() < DateTime.UtcNow.AddMinutes(-_bufferMins))
return;
Regards,
Ryan

Answer 1

Hello Ryan,
I created a small demo which could make the scenario: the event mesage could be delayed:
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
namespace P20150409
class Program
static void Main(string[] args)
EventLog myNewLog = new EventLog("Application", ".", "dotNET Sample App");
myNewLog.EntryWritten += new EntryWrittenEventHandler(MyOnEntryWritten);
myNewLog.EnableRaisingEvents = true;
while (true)
System.Threading.Thread.Sleep(3000);
string EventWriteTime = DateTime.Now.ToString();
Console.WriteLine("Log is written at" + EventWriteTime);
myNewLog.WriteEntry("Test message written at" + EventWriteTime + " " + System.Threading.Thread.CurrentThread.ManagedThreadId, EventLogEntryType.Information);
Console.WriteLine();
Console.ReadLine();
private static void MyOnEntryWritten(object sender, EntryWrittenEventArgs e)
System.Threading.Thread.Sleep(6000);
Console.WriteLine("EntryWritten event is fired at" + DateTime.Now.ToString());
Console.WriteLine("Log time is" + e.Entry.Message);
Console.WriteLine();
This is the result:
As we can see that the interval between event fired time and the current written time is bigger and bigger, so it could be that an event is fired 2 year later...And for reason, we can see that it is becuase i set the event sleep 6s whenever it
is fired. So i am wondering in your event, there is a similar feature which causes this delay.
Regards.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.