Skip to content

Load logs newest-first for fast first paint and cut resolver memory #615

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jschick04 merged 9 commits into from
Jun 21, 2026
Merged

Load logs newest-first for fast first paint and cut resolver memory #615

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
fa0de36
Add reverse-read support and a direction-agnostic newest bookmark to …
jschick04 Jun 20, 2026
e8a66a2
Read logs newest-first and eagerly paint the first screenful
jschick04 Jun 20, 2026
8bf0300
Read event variants via pointer and match EvtVariant to MSDN
jschick04 Jun 20, 2026
e957246
Read value-type system properties without boxing in GetEventRecord
jschick04 Jun 20, 2026
01e1c4c
Prioritize a newly-opened log's first screenful over bulk resolution
jschick04 Jun 20, 2026
facf3b2
Enable Server GC for faster parallel event resolution
jschick04 Jun 20, 2026
c072400
Read event batches of 256 and release handles on a failed read
jschick04 Jun 20, 2026
2201d5f
Store provider messages compactly to cut resolver memory
jschick04 Jun 21, 2026
3d39cd3
Load provider message-table entries on demand to cut resolver memory
jschick04 Jun 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 37 additions & 19 deletions src/EventLogExpert.Eventing/Interop/EvtVariant.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,28 +8,46 @@ namespace EventLogExpert.Eventing.Interop;
[StructLayout(LayoutKind.Explicit)]
internal readonly record struct EvtVariant
{
[FieldOffset(0)] internal readonly uint UInteger;
[FieldOffset(0)] internal readonly int Integer;
[FieldOffset(0)] internal readonly byte UInt8;
[FieldOffset(0)] internal readonly short Short;
[FieldOffset(0)] internal readonly ushort UShort;
[FieldOffset(0)] internal readonly uint Bool;
[FieldOffset(0)] internal readonly int BooleanVal;
[FieldOffset(0)] internal readonly sbyte SByteVal;
[FieldOffset(0)] internal readonly short Int16Val;
[FieldOffset(0)] internal readonly int Int32Val;
[FieldOffset(0)] internal readonly long Int64Val;
[FieldOffset(0)] internal readonly byte ByteVal;
[FieldOffset(0)] internal readonly byte SByte;
[FieldOffset(0)] internal readonly ulong ULong;
[FieldOffset(0)] internal readonly long Long;
[FieldOffset(0)] internal readonly float Single;
[FieldOffset(0)] internal readonly double Double;
[FieldOffset(0)] internal readonly ushort UInt16Val;
[FieldOffset(0)] internal readonly uint UInt32Val;
[FieldOffset(0)] internal readonly ulong UInt64Val;
[FieldOffset(0)] internal readonly float SingleVal;
[FieldOffset(0)] internal readonly double DoubleVal;
[FieldOffset(0)] internal readonly ulong FileTimeVal;
[FieldOffset(0)] internal readonly nint SysTimeVal;
[FieldOffset(0)] internal readonly nint GuidVal;
[FieldOffset(0)] internal readonly nint StringVal;
[FieldOffset(0)] internal readonly nint AnsiString;
[FieldOffset(0)] internal readonly nint AnsiStringVal;
[FieldOffset(0)] internal readonly nint BinaryVal;
[FieldOffset(0)] internal readonly nint SidVal;
[FieldOffset(0)] internal readonly nint Binary;
[FieldOffset(0)] internal readonly nint Reference;
[FieldOffset(0)] internal readonly nint Handle;
[FieldOffset(0)] internal readonly nint GuidReference;
[FieldOffset(0)] internal readonly ulong FileTime;
[FieldOffset(0)] internal readonly nint SystemTime;
[FieldOffset(0)] internal readonly nint SizeT;
[FieldOffset(0)] internal readonly nuint SizeTVal;
[FieldOffset(0)] internal readonly nint BooleanArr;
[FieldOffset(0)] internal readonly nint SByteArr;
[FieldOffset(0)] internal readonly nint Int16Arr;
[FieldOffset(0)] internal readonly nint Int32Arr;
[FieldOffset(0)] internal readonly nint Int64Arr;
[FieldOffset(0)] internal readonly nint ByteArr;
[FieldOffset(0)] internal readonly nint UInt16Arr;
[FieldOffset(0)] internal readonly nint UInt32Arr;
[FieldOffset(0)] internal readonly nint UInt64Arr;
[FieldOffset(0)] internal readonly nint SingleArr;
[FieldOffset(0)] internal readonly nint DoubleArr;
[FieldOffset(0)] internal readonly nint FileTimeArr;
[FieldOffset(0)] internal readonly nint SysTimeArr;
[FieldOffset(0)] internal readonly nint GuidArr;
[FieldOffset(0)] internal readonly nint StringArr;
[FieldOffset(0)] internal readonly nint AnsiStringArr;
[FieldOffset(0)] internal readonly nint SidArr;
[FieldOffset(0)] internal readonly nint SizeTArr;
[FieldOffset(0)] internal readonly nint EvtHandleVal;
[FieldOffset(0)] internal readonly nint XmlVal;
[FieldOffset(0)] internal readonly nint XmlValArr;
[FieldOffset(8)] internal readonly uint Count;
[FieldOffset(12)] internal readonly uint Type;
}
280 changes: 178 additions & 102 deletions src/EventLogExpert.Eventing/Interop/NativeMethods.Evt.cs
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 3 additions & 0 deletions src/EventLogExpert.Eventing/Interop/NativeMethods.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,9 @@ internal static partial LibraryHandle LoadLibraryExW(
[LibraryImport(Kernel32Api)]
internal static partial IntPtr LockResource(IntPtr hResData);

[LibraryImport(Kernel32Api, SetLastError = true)]
internal static partial uint SizeofResource(LibraryHandle hModule, IntPtr hResInfo);

private static string? FormatMessageFromModule(IntPtr moduleHandle, uint messageId) =>
FormatMessageWithRetry(
FORMAT_MESSAGE_FROM_HMODULE | FORMAT_MESSAGE_IGNORE_INSERTS,
Expand Down
Loading