C# Application crash cause

Question

I am investigating a crash happening in one of my applications: I have found out that it is because I am subscribing to the EventLog.EntryWritten event to monitor the event log for EntryWritten events. I have been looking at the EventLog class in Reflector and following the call stack in WinDBG to see where my application is failing. First of all, here is the output of !eestack in WinDBG around where my application is failing:

0632e620 74c9e900 mscorwks!StrongNameErrorInfo+0x103e4, calling mscorwks!GetMetaDataInternalInterface+0x7f70
0632e694 74c9e855 mscorwks!StrongNameErrorInfo+0x10339, calling mscorwks+0x31c0
0632e6a0 74215058 (MethodDesc 0x7402b7c4 +0x18 System.Security.CodeAccessPermission.RevertAssert()), calling (MethodDesc 0x740c84fc +0 System.Security.SecurityRuntime.RevertAssert(System.Threading.StackCrawlMark ByRef))
0632e6ac 73df4598 (MethodDesc 0x738bc65c +0xa0 System.Diagnostics.SharedUtils.CreateSafeWin32Exception(Int32)), calling (MethodDesc       0x7402b7c4 +0 System.Security.CodeAccessPermission.RevertAssert())
0632e6e4 73ee6fa0 (MethodDesc 0x738e064c System.Diagnostics.EventLog.get_OldestEntryNumber()), calling mscorwks!StrongNameErrorInfo+0x1031b
0632e6f4 73df24ed (MethodDesc 0x738e06e8 +0x1bd System.Diagnostics.EventLog.CompletionCallback(System.Object)), calling (MethodDesc    0x738e064c +0 System.Diagnostics.EventLog.get_OldestEntryNumber())
0632e728 74bb8cef mscorwks!CoUninitializeEE+0x5687, calling mscorwks!CoUninitializeEE+0x5613
0632e73c 73df0fe4 (MethodDesc 0x738e096c +0x94 System.Diagnostics.EventLog.StaticCompletionCallback(System.Object, Boolean)), calling 739443d4

Roughly following that from what I see in Reflector here is a part of the get accessor for OldestEntryNumber:

if (!UnsafeNativeMethods.GetOldestEventLogRecord(this.readHandle, number))
{
    throw SharedUtils.CreateSafeWin32Exception();
}

This Win32Exception is what is causing my application to crash. Looking at the UnsafeNativeMethods.GetOldestEventLogRecord(...) method:

[DllImport("advapi32.dll", CharSet=CharSet.Unicode, SetLastError=true)]
public static extern bool GetOldestEventLogRecord(SafeHandle hEventLog, int[] number);

So I am guessing my problem is either one of 2 things:

1. The GetOldestEventLogRecord(...) method is failing for some reason.
2. The system is unable to access/load the advapi32.dll. Could this be why I see StrongNameErrorInfo+0x1031b around where it could be calling this method in the output of !eestack?

Any ideas or help on this would be really helpful and appreciated!

Answer 1

You're P/Invoke seems to be wrong.

Try changing it to:

[DllImport ("advapi32.dll", SetLastError=true)]
public static extern int GetOldestEventLogRecord (IntPtr hEventLog, ref int OldestRecord);

By the way, there is an alternative way to retrieve these informations: using managed EventLog classes.

System.Diagnostics.EventLogEntryCollection