Does this code defer retrieval of the event logs until they've been queried?

Question

Where log is an object of type EventLog, does this code...

log.Entries.Cast<EventLogEntry>().Where(x => x.TimeGenerated == myDate).ToList();

...somehow query (my Where lambda) prior to retrieving all of the logs so that it performs better? (Similarly to how EF would with a DB query) Or does it first pull the entire log into memory and filter from there?

If the latter, is it 'best' (i.e. fast, and more 'performant') to use this approach instead (i.e. pass in the XML and let the query do the lifting)?

I may have worded this a little awkwardly, I'm basically asking if the first approach I mentioned is inefficient for querying.

Answer 1

No it does not perform any better, because log.Entries implement simple IEnumerable, not something like IQueryable (like EF does for example). It means it does not analyze your "Where" clause expression tree and does not convert it somehow to event query before enumeration. So your query is roughly the same as:

var result = new List<EventLogEntry>();
foreach (EventLogEntry x in log.Entries) {
    if (x.TimeGenerated == myDate) {
        result.Add(x);
    }
}
return result;