When executing WQL queries to fetch high-volume logs (such as Windows Security Logs) in certain environments, the library currently retrieves messages one by one. Because of this single-element polling behavior, large queries frequently hit a timeout before completing.
While this could theoretically be adjusted on the Windows host side, a cleaner and more robust solution is to allow the client library to configure batch sizing and pull timeouts directly within the WS-Management protocol layer via the MaxElements and MaxTime elements.
Current Behavior
The library issues enumeration and pull requests without explicit batch size limits, causing the host to default to a single-item delivery or unoptimized streaming that results in connection timeouts on large datasets.
Proposed Solution
Expose configuration options in the library to let users define:
- Batch Size (MaxElements): To optimize both the initial enumeration and subsequent pull requests.
- Optimize Enumeration (OptimizeEnumeration): To signal the server to return the first batch of elements immediately within the initial enumeration response rather than waiting for a separate pull request.
- Pull Timeout (MaxTime): To manage how long a pull request should wait.
Expected XML Payload Changes
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
xmlns:wsen="http://schemas.xmlsoap.org/ws/2004/09/enumeration">
........
<s:Body>
<wsen:Enumerate>
<wsen:OptimizeEnumeration />
<wsen:MaxElements>100</wsman:MaxElements>
</wsen:Enumerate>
</s:Body>
</s:Envelope>
<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
xmlns:wsen="http://schemas.xmlsoap.org/ws/2004/09/enumeration">
........
<s:Body>
<wsen:Pull>
<wsen:EnumerationContext>123</wsen:EnumerationContext>
<wsen:MaxTime>P30S</wsen:MaxTime>
<wsen:MaxElements>100</wsen:MaxElements>
</wsen:Pull>
</s:Body>
</s:Envelope>
Impact
Implementing these configurations will significantly improve performance and stability when fetching large event logs, preventing premature timeouts and reducing network overhead through proper message batching.
When executing WQL queries to fetch high-volume logs (such as Windows Security Logs) in certain environments, the library currently retrieves messages one by one. Because of this single-element polling behavior, large queries frequently hit a timeout before completing.
While this could theoretically be adjusted on the Windows host side, a cleaner and more robust solution is to allow the client library to configure batch sizing and pull timeouts directly within the WS-Management protocol layer via the MaxElements and MaxTime elements.
Current Behavior
The library issues enumeration and pull requests without explicit batch size limits, causing the host to default to a single-item delivery or unoptimized streaming that results in connection timeouts on large datasets.
Proposed Solution
Expose configuration options in the library to let users define:
Expected XML Payload Changes
Impact
Implementing these configurations will significantly improve performance and stability when fetching large event logs, preventing premature timeouts and reducing network overhead through proper message batching.