Skip to content

EventLogReader: EventRecord objects may reference disposed reader resources #223

@Christophe-Rogiers

Description

@Christophe-Rogiers

Bug Description

EventLogReader.ReadEvents() disposes the system EventLogReader via using, but the EventRecord objects it returned are still alive in the returned list. EventRecord may internally hold references to the reader's unmanaged resources. The FormatDescription() call in EventLogService.cs (line 81) could fail with ObjectDisposedException under load.

Location

File: src/Servy.Core/Logging/EventLogReader.cs
Lines: 13-27

Code

public IEnumerable<EventRecord> ReadEvents(EventLogQuery query)
{
    using (var reader = new System.Diagnostics.Eventing.Reader.EventLogReader(query))
    {
        var results = new List<EventRecord>();
        for (EventRecord evt = reader.ReadEvent(); evt != null; evt = reader.ReadEvent())
        {
            results.Add(evt);
        }
        return results;  // reader disposed, but EventRecords may hold internal refs
    }
}

Suggested Fix

Process each EventRecord inside the using block and return DTOs instead of raw records:

public IEnumerable<EventLogEntry> ReadEvents(EventLogQuery query)
{
    using (var reader = new System.Diagnostics.Eventing.Reader.EventLogReader(query))
    {
        var results = new List<EventLogEntry>();
        for (EventRecord evt = reader.ReadEvent(); evt != null; evt = reader.ReadEvent())
        {
            using (evt)
            {
                results.Add(MapToEntry(evt));
            }
        }
        return results;
    }
}

Severity

Warning

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions