title: A mystery IndexOutOfRange Exception recurring when reading from a full EventLog
body: <p>I'm maintaining an application which uses the Windows Application Event Log to 'scan' for errors from another application. </p>
  
  <p>I need to find the first entry occurring since a specified time. So, what I've done so far is looped back from the latest Event Log entry (<code>Entries.Count-1</code>), until an entry is found <em>before</em> the specified time. The next entry must be the first one since this specified time, so I then loop forwards from this entry until the last one (<code>Entries.Count-1</code>). </p>
  
  <p>However. I keep getting <code>IndexOutOfRange Exceptions</code> which I am finding difficult to resolve or understand. </p>
  
  <p>Also, I have realised that some of my assumptions about the Event Log are very likely to be faulty - and I am struggling to find relevant documentation to correct myself. </p>
  
  <p>The <code>IndexOutOfRange Exception</code> only occurs when the EventLog is full. Also, the <a href="https://technet.microsoft.com/en-us/library/cc721981.aspx" rel="nofollow">log retention policy setting</a> is set to 'Overwrite events as needed.'</p>
  
  <hr>
  
  <p><strong>Code</strong> </p>
  
  <pre><code>// This method is called every time a log is written to the Application Event Log
  private void parseApplicationLogEntries()
  { 
      // Assumes the first log since the specified time is the most recent one
      int firstLog = log.Entries.Count-1;
  
      // Loops through the logs from the last one until the first,
      // stopping if it finds one before the specified time. 
      // The next entry must be the first one since the specified
      // time, so set the firstLog to its index and then break. 
      for (int entry = log.Entries.Count - 1; entry &gt; 0; entry--)
      {
          DateTime logEntryTimeWritten = log.Entries[entry].TimeWritten;
  
          if (logEntryTimeWritten &lt; specifiedTime)
          {
               firstLog = entry + 1;
               break;
          }
      }
  
      //
      for (int entry = firstLog; entry &lt;= log.Entries.Count - 1; entry++)
      {
          string logSource = log.Entries[entry].Source; 
  
          if (logSource == sourceIAmLookingFor)
          {
              // Do some stuff
              // It's found, so break
          }
      }
  }
  </code></pre>
  
  <p>So. There are plenty of doubtful assumptions here, and no Exception handling where there should obviously be some. </p>
  
  <ol>
  <li><p>This makes the assumption that the Event Log indexes are ordered from oldest to newest entry, by time. (e.g. <code>Entries[0]</code> is the oldest entry, and <code>Entries[Entries.Count-1]</code> is the newest entry)</p></li>
  <li><p>There is no Exception Handling to catch the IndexOutOfRange Exception. </p></li>
  </ol>
  
  <hr>
  
  <p><strong>Work towards a solution so far</strong></p>
  
  <ul>
  <li><p>Researched the <a href="https://msdn.microsoft.com/en-us/library/System.Diagnostics.EventLog(v=vs.110).aspx" rel="nofollow">EventLog</a> on MSDN and elsewhere. </p></li>
  <li><p>Written a program to flood the Event Log with entries in an attempt to replicate the conditions under which the Exception is occurring. (I cannot get the issue to recur under a development environment, even though it recurs frequently in a live environment.) </p></li>
  </ul>
  
  <hr>
  
  <p>I am honestly at a complete loss. I can think of some 'half-fixes' (e.g. make the Event Log's maximum size huge, and stick in an Exception handler which just does nothing) - but what I really want is to understand why this is happening and fix it <em>properly</em>. Since the index should always be between <code>0</code> and <code>Entries.Count-1</code> I don't have a clue. </p>
  
  <p>Any thoughts?</p>