Skip to content

fix: System Report's problem list counts the whole week, and each report goes by its own read of the log - #2946

Merged
laurentiu021 merged 1 commit into
mainfrom
fix/report-counts-the-whole-week
Oct 22, 2026
Merged

laurentiu021 merged 1 commit into
mainfrom
fix/report-counts-the-whole-week

Conversation

@laurentiu021

Copy link
Copy Markdown
Owner

System Report's "System log problems (last 7 days)" read the 500 newest critical and error events of the week and
stopped. One noisy source can log 500 errors in a day or two, so a critical event from earlier in the week, an
unexpected shutdown for one, was never read, and the noisy one read "500 times" whatever its real count. And the
report learned how its read went from LastOutcome on an EventLogService that System Report and About share
through one SystemReportService, so one report's read could reset or set the other's result.

What changed

  • EventLogService.TallyAsync counts every record of the asked severities in the window, grouped by source and event
    ID, and reads no message: formatting the message is the slow part of a record, and a count needs only the source,
    ID, level and time. On my PC, counting a week of the System log took 0.32 to 0.40 seconds over three runs, against
    the report's 15-second budget.
  • It reads 256 records per hop to the thread pool and checks the cancel between batches. A fault ends it as
    Unavailable with no groups, as the Logs tab's read ends, so a read cut short is never listed as the whole week.
  • The outcome comes back with the groups, and the report no longer reads LastOutcome.
  • SummarizeProblems takes the groups. The report still carries no event message ([Bug]: About / System Report — the exported report carries the machine's MAC address and local IP, undisclosed, in all three formats #2352); a test pins that neither
    record the count builds has one.
  • CHANGELOG 1.130.55, README (System Report), ARCHITECTURE (EventLogService, SystemReportService).

Tests

  • 600 errors of one source and an older critical event: both counted, 600 and 1.
  • A log that ends on a batch boundary, the severity filter, a group's newest time and its critical flag.
  • A fault returns no groups and Unavailable; a cancel throws within one batch, against a source long enough that
    only the cancel can end it.
  • TallyAsync on a missing log returns LogNotFound and leaves LastOutcome at Ok.
  • Integration: a week of the real System log counted inside the report's budget.

Each test failed against the defect it pins: with the count stopped at 500 (the 600-error, batch-boundary and cancel
tests), with every severity counted, a group critical only by its last record, the first record taken as the newest,
a fault returning what was counted, the cancel ignored, the outcome written to LastOutcome, and a full batch taken
as the end of the log.

Closes #2827.

…ort goes by its own read of the log

- EventLogService.TallyAsync counts every record of the asked severities in a window, grouped by source and event
  ID, and reads no message. The report read the 500 newest critical and error events and stopped, so one noisy
  source used them up in a day or two, an older critical event was never read, and a count stopped at 500.
  Formatting the message was the slow part of a record, and a count needs only the source, ID, level and time.
- It reads 256 records per hop to the thread pool and checks the cancel between them. A fault ends it as Unavailable
  with no groups, as the Logs tab's read ends, so a read cut short is never listed as the whole week.
- The outcome comes back with the groups. System Report and About make their reports through one
  SystemReportService, and its read of LastOutcome could be the other report's.
- SummarizeProblems takes the groups. The report still carries no event message, and a test pins that neither
  record the count builds has one.
@laurentiu021
laurentiu021 merged commit 05c15b3 into main Oct 22, 2026
6 checks passed
@laurentiu021
laurentiu021 deleted the fix/report-counts-the-whole-week branch October 22, 2026 00:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: System Report — the "last 7 days" problem list reads only the 500 newest errors, and two reports at once share one read result

1 participant