All,
Our serves are upgraded to Windows 2012 R2, we have log4net implemented with
alert emails. I have MultiThresholdNotifyingAppender ,which reads the event log
from the event viewer, when it reaches the threshold limit ,it will send an
alert email to the developers.
Everything is working in old severs, but in Windows 2012 , the Timestamp is
coming up wrong while reading from the event viewer .
It reads the first created log error (eg 2014-12-05T14:29:02.1578078-05:00 )
,for all the errors logged after this , it's reading the same time stamp. Pls
see the attached code.
Thanks,
Vanitha Venkatasamy
XPAND Corporation.
[contact_email]
This message contains Devin Group confidential information and is intended only
for the individual named. If you are not the named addressee you should not
disseminate, distribute or copy this e-mail. Please notify the sender
immediately by e-mail if you have received this e-mail in error and delete this
e-mail from your system. E-mail transmissions cannot be guaranteed secure,
error-free and information could be intercepted, corrupted, lost, destroyed,
arrive late, incomplete, or contain viruses. The sender therefore does not
accept liability for errors or omissions in the contents of this message which
may arise as result of transmission. If verification is required please request
hard-copy version
using System;
using System.Collections.Generic;
using System.Web;
using log4net;
using log4net.Core;
using System.Threading;
using log4net.Appender;
using log4net.Config;
using System.Web.Mail;
using System.Linq;
using System.Linq.Expressions;
using System.Text;
using System.Xml;
using System.Xml.Linq;
using System.IO;
using System.Configuration;
namespace sendAlertAppender
{
public class MultiThresholdNotifyingAppender : AppenderSkeleton
{
public MultiThresholdNotifyingAppender()
{
}
private Queue<LoggingEvent> loggingEventQueue ;
private DateTime windowStart ;
protected int eventCount = 0;
Level _levelthreshold;
TimeSpan _windowLength =
TimeSpan.FromMinutes(Convert.ToDouble(System.Configuration.ConfigurationSettings.AppSettings["TimeLimit"].ToString()));
int _hitThreshold =
Convert.ToInt32(Convert.ToDouble(System.Configuration.ConfigurationSettings.AppSettings["Threshold"].ToString()));
protected override void Append(LoggingEvent loggingEvent)
{
if (loggingEvent.MessageObject.ToString().Contains("404"))
return;
loggingEventQueue = new Queue<LoggingEvent>();
if (loggingEvent.Level < LevelThreshold)
{
if (loggingEventQueue.Count == 0)
return;
if ((loggingEvent.TimeStamp - windowStart) >= WindowLength)
{
//Error level is less than threshold and the time window
has elapsed. Remove any queued LoggingEvents
//until all LoggingEvents in the queue fall within the time
window.
while (loggingEventQueue.Count > 0 &&
loggingEventQueue.Peek().TimeStamp - windowStart >= WindowLength)
{
loggingEventQueue.Dequeue();
}
windowStart = loggingEventQueue.Peek().TimeStamp;
return;
}
}
//If we got here, then the Error level is >= the threshold. We
want to save the LoggingEvent and we MIGHT
//want to notify the administrator if the other criteria are met
(number of errors within time window).
loggingEventQueue.Enqueue(loggingEvent);
//If this is the first error in the queue, start the time window.
//if (eventCount == 1)
// windowStart = loggingEvent.TimeStamp;
string path =
System.Configuration.ConfigurationSettings.AppSettings["filePath"].ToString();
//String path = HttpContext.Current.Server.MapPath("filePath");
int i;
if (System.IO.File.Exists(path))
{
XDocument docs = XDocument.Load(path);
XElement xele = docs.Descendants("ErrData").FirstOrDefault();
if (xele != null)
{
i =
Convert.ToInt32(docs.Descendants("ErrData").LastOrDefault().Element("Count").Value.ToString());
eventCount = i;
if (i < _hitThreshold + 1)
{
eventCount = eventCount + 1;
var temp =
docs.Descendants("ErrData").FirstOrDefault().Element("Timestamp").Value.ToString();
windowStart = Convert.ToDateTime(temp);
}
else if (i > _hitThreshold)
{
eventCount = eventCount + 1;
var temp =
docs.Descendants("ErrData").FirstOrDefault().Element("Timestamp").Value.ToString();
var temp2 =
docs.Descendants("ErrData").LastOrDefault().Element("Timestamp").Value.ToString();
windowStart = Convert.ToDateTime(temp);
}
}
else
{
eventCount = eventCount + 1;
windowStart = loggingEvent.TimeStamp;
}
}
else
{
eventCount = eventCount + 1;
windowStart = loggingEvent.TimeStamp;
}
//Now we're talking! A lot of error messages in a short period of
time.
if ((loggingEvent.TimeStamp - windowStart >= WindowLength) &&
(eventCount < _hitThreshold))
{
//After sending the message, clear the LoggingEvents and reset
the XMLFile.
eventCount = 1;
ClearXMLFile(loggingEvent, path, eventCount);
WritetoXML(path);
}
else if ((loggingEvent.TimeStamp - windowStart >= WindowLength)&&
(eventCount > _hitThreshold))
{
//After sending the message, clear the LoggingEvents and reset
the XMLFile. If there are more error(>20) logged in 5 min
sendEmail(eventCount);
eventCount = 0;
ClearXMLFile(loggingEvent, path, eventCount);
}
else
{
WritetoXML(path);
}
}
private void WritetoXML(String path)
{
XDocument doc = null;
XElement el;
if (!System.IO.File.Exists(path))
{
doc = new XDocument(new XDeclaration("1.0", "utf-8", "no"));
el = new XElement("root");
XComment comment = new XComment("Log the error count and error
message");
doc.Add(comment);
}
else
{
doc = XDocument.Load(path);
}
XElement p1 = new XElement("ErrData");
XElement p1Count = new XElement("Count", eventCount);
XElement p1Timestamp = new XElement("Timestamp", windowStart);
p1.Add(p1Count);
p1.Add(p1Timestamp);
if (doc.Root != null)
{
el = doc.Root;
el.Add(p1);
}
else
{
el = new XElement("root");
el.Add(p1);
}
try
{
doc.Add(el);
}
catch (Exception e)
{
}
finally
{
doc.Save(path);
}
}
private void ClearXMLFile(LoggingEvent loggingEvent, String path, int
eventCount)
{
eventCount = 0;
windowStart = loggingEvent.TimeStamp;
XDocument docs = XDocument.Load(path);
try
{
docs.Root.DescendantNodes().Remove();
}
catch (Exception ex)
{
}
finally
{
docs.Save(path);
}
}
public void sendEmail(int count)
{
System.Web.Mail.MailMessage myMail = new
System.Web.Mail.MailMessage();
myMail.To =
System.Configuration.ConfigurationSettings.AppSettings["EmailTo"].ToString();
myMail.Cc =
System.Configuration.ConfigurationSettings.AppSettings["EmailCc"].ToString();
myMail.From =
System.Configuration.ConfigurationSettings.AppSettings["EmailFrom"].ToString();
string strSubject =
System.Configuration.ConfigurationSettings.AppSettings["Source"].ToString();
string strLog =
System.Configuration.ConfigurationSettings.AppSettings["Log"].ToString();
string strSmtp =
System.Configuration.ConfigurationSettings.AppSettings["Smtp"].ToString();
myMail.Subject = strSubject+" Error Alert";
StringBuilder strMessgae = new StringBuilder();
string serverName =
System.Environment.MachineName.ToString().Substring(0,
Math.Min(System.Environment.MachineName.ToString().Length, 18));
strMessgae.Append("\n" + "Alert Time:" + DateTime.Now + "\n\n");
strMessgae.Append("EventLog Name: " + strLog + "\n\n");
strMessgae.Append("Error log records exceeded the threshold, which
indicates a major problem..." + "\n\n");
strMessgae.Append(" Number of records logged in Server "+
serverName +" over the past 5 minutes are ("+count+") records" + "\n\n");
myMail.Body = strMessgae.ToString();
if (strSmtp == string.Empty)
{
SmtpMail.SmtpServer = "10.3.13.108";
}
else
{
SmtpMail.SmtpServer = strSmtp;
}
SmtpMail.Send(myMail);
}
public Level LevelThreshold
{
get
{
return _levelthreshold;
}
set
{
_levelthreshold = value;
}
}
public TimeSpan WindowLength
{
get
{
return _windowLength;
}
set
{
_windowLength = value;
}
}
public int HitThreshold
{
get
{
return _hitThreshold;
}
set
{
_hitThreshold = value;
}
}
public void Append(LoggingEvent[] loggingEvents)
{
foreach (LoggingEvent le in loggingEvents)
{
Append(le);
}
}
public string WriteString(String text)
{
string temp = string.Empty;
temp = text.ToUpper();
return temp;
}
}
}
