C# .NET - Writing to custom event log. - Asked By Byron King on 30-Apr-07 11:53 AM

Hi.  I am attempting to write to a custom event log, but whenever I try, the message goes straight to the Application log.  Here's the code:

[CODE]
            if (EventLoggingEnabled)
            {
                EventLog log = new EventLog();
                log.Source = "Custom Log Security Library";
                log.WriteEntry("This is a test message.", EventLogEntryType.Information);
            }
[/CODE]

I see my message correctly displayed in the App log, but I want it to go in my custom log.  As for the registry, I have the source defined at:

HKLM/SYSTEM/CurrentControlSet/Services/EventLog/CustomLog/CustomSource.

Any idea what I'm missing here?  Thanks.

Take a looky here - Peter Bromberg replied to Byron King on 30-Apr-07 02:54 PM

http://support.microsoft.com/kb/815314


in the "Create Custom Logs" section.


Byron King replied to Peter Bromberg on 30-Apr-07 04:14 PM
Peter,

Thanks for the response.  Actually, the article you posted was the first place I looked when I first attempted to write to the event logs.  The strange thing is that my event source is not getting "unbound" from the Application log no matter what I do.  I've deleted the custom log, deleted the source, rebooted, etc.  The code I use to create the custom source is:

[CODE]
            if (EventLoggingEnabled)
            {
                string errorMessage = string.Format(Resources.Culture, Resources.TicketCreationFailure, instanceName);
                string entryText = eventLogEntryFormatter.GetEntryText(errorMessage, e.ExceptionMessage, e.ErrorMessage);

                if (!(EventLog.SourceExists(Resources.EventSource, System.Environment.MachineName)))
                {
                    EventLog.CreateEventSource(Resources.EventSource, Resources.EventLog);
                }

                EventLog.WriteEntry(Resources.EventSource, entryText, EventLogEntryType.Information);
            }
[/CODE]

Deleting the event source produces a message in the Application log like this:

The description for Event ID ( 0 ) in Source ( ADC .NET Security Library ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: An error occurred in application WindowsAppHarness.vshost.exe in the Advertising.Security.
The authentication ticket was created for .
04/30/2007 4:10:02 PM
.
If I go into the registry and restore the missing source, I get a correct event log message, but still in the incorrect log.  Any other ideas are greatly appreciated.

Custom Event logs - Matthew Sanchez replied to Byron King on 15-Jan-08 06:20 PM

Have you tried using this:

EventLog.CreateEventSource(string source, string logname);

 

 

Greg replied to Byron King on 18-Jun-10 03:26 PM
Once you create an event source, you cannot reuse that event source name. The framework searches through all of the event sources on the machine, and if it finds one that matches the name, it uses it. To make the code work properly, you need to create a new event source.