Description
Issue description
We hit a problem with where a ticket was raised for Microsoft Support.
The problem is about an your event watcher application which is using "System.Diagnostics.Eventing.Reader" namespace (.NET 4.8).
The customer has observed that the EvtNext API https://docs.microsoft.com/en-us/windows/win32/api/winevt/nf-winevt-evtnext (wevtapi.cpp) is being called by the EventLogWatcher API:
https://github.com/microsoft/referencesource/blob/master/System.Core/System/Diagnostics/Eventing/Reader/EventLogWatcher.cs and the ERROR_INVALID_HANDLE is returned for hundreds of times when an exception instead of an event is being returned from the server.
IN order to resolve the exceptions that were happening due to network problems we had to dispose the EventLogWatcher object and to reconnect it.
<include description here>
Target framework
Check the .NET target framework(s) being used, and include the version number(s).
- .NET Core
- [x ] .NET Framework 4.7.2 / 4.8
- .NET Standard
If using the .NET Core SDK, include dotnet --info
output. If using .NET Framework without the .NET Core SDK, include info from Visual Studio's Help > About Microsoft Visual Studio dialog.
dotnet --info output or About VS info
<replace>
```in the page https://docs.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventrecordwritteneventargs.eventexception?view=dotnet-plat-ext-3.1#System_Diagnostics_Eventing_Reader_EventRecordWrittenEventArgs_EventException We can add a remark section telling something like the following:
“The event subscription could fail if the server producing the events start to fail. At that time exceptions will start to raise. The apps can decide to dispose the EventLogWatcher object and try to reconnect to avoid getting more subsequent exceptions”.
</details>