Share via

EvtSubscribe not returning signal when using pull subscription , what am i doing wrong?

Ajay Adithya Udayakumar 15 Reputation points
2024-08-28T06:21:33.9266667+00:00

I used the same code given in [Microsoft documentation] (https://learn.microsoft.com/en-us/windows/win32/wes/subscribing-to-events#pull-subscriptions) to collect logs in real-time by subscribing to the event source "Application" in the event viewer but when the logs flow rate is high/log collection prolongs continuously for longer duration say 1-2days the waitForMultipleObjects function stop returning the signal.To simulate logs from PowerShell the following command was used and the EvtSubscribe query param were as follows

For($x=1; $x -lt 2000000; $x=$x+1){Write-EventLog -LogName "Application" -Source "MyApps" -EventID 1116 -EntryType Error -Message    "MyApp." -Category 1 -RawData 10,20}

pwsPath = L"Application"
pwsQuery = "*"
EvtSubscribe(NULL, aWaitHandles[1], pwsPath, pwsQuery, NULL, NULL,NULL,EvtSubscribeStartAtOldestRecord);

From the a above PowerShell command the log collection from the application runs for around 10minutes and stops abruptly and the event xmls are not printed in command prompt\console application
Tried with push subscription - for reference , and it works as intended and the log collection doesn't stop with high flow/log duration of time
As push subscription wont scale for my use case, I am in need to make pull subscription work for the same. Kindly help and provide insights

Windows development | Windows API - Win32
Windows for business | Windows Server | User experience | PowerShell
Developer technologies | C++
Developer technologies | C++

A high-level, general-purpose programming language, created as an extension of the C programming language, that has object-oriented, generic, and functional features in addition to facilities for low-level memory manipulation.


Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.