0

I'm trying to create a simplified API for both logging (errors, warnings, info) and tracing (debug, analytics) to the Windows Event Log so I can use Windows Event Viewer to work with the logs. I found the EventLog class and started coding against it, and it works for logging to the Application log. I can't find any documentation on specifying the log subcategory with this class, though. I need to push trace info to the Analytic and Debug logs, and I'd like to let the application choose whether logged events go to the Admin or Operational logs.

I then learned about the EventSource class, and various blogs on MSDN indicate that it does allow you to specify the logging "channel", but I don't know whether the channel is another word for the log subcategory.

This is the only thread I could find comparing the two classes, and it didn't seem to answer what I need to know:

  1. Can I use either EventLog or EventSource for logging to a specific to WEL subcategory?
  2. Is one of them recommended over the other in the .NET 4.5 framework? i.e. is EventLog considered to be deprecated, or is it meant only for non-trace use?
Stobber
  • 162
  • 2
  • 12
  • I would strongly suggest using an existing framework like NLog that can write to many different targets including the Event Log, rather than reinventing the wheel. – Eric J. Sep 25 '14 at 16:51
  • I would also strongly suggest something like Enterprise Library Logging, http://msdn.microsoft.com/en-us/library/dn169621.aspx. It has operations to handle event log entries as well as database logging and email notifications. Its pretty simple to implement as well. – Bearcat9425 Sep 25 '14 at 17:18
  • Solid recommendations above, assuming I'm writing my apps in a .NET language. The real story is a bit more complicated: I'm creating a logging API for LabVIEW, which has a way to invoke .NET assemblies from its own runtime engine. I want to work against classes that are native to the framework, so my LabVIEW clients don't have to download .NET packages using NuGet or the like. This precludes using log4net, ELL, etc. – Stobber Sep 29 '14 at 16:09

3 Answers3

0

Yes you can use EventLog as shown here or EventSource as shown here and here. I know of no official recommendation, but in my opinion it is easier to write a strong typed log message with EventSource. It also has more features and with this you can even use it with .Net 3.5 if you want.

Community
  • 1
  • 1
Lars Truijens
  • 42,837
  • 6
  • 126
  • 143
0

Looks like I misinterpreted the Help/TechNet info on these logs. There are the Windows Logs -- Application Security, Setup, System, ForwardedEvents -- and then there are custom Applications and Services Logs. Only the latter may have a subtype: Admin, Operational, Analytic, Debug. The Windows Logs don't have subtypes, and they're intended only for logging (not tracing), so they don't accept a logging level that equates to "Debug" or "Trace".

That being said, the EventLog class suits my needs for logging, but it doesn't seem to provide enough features to interface with ETW for tracing. If I want to write to trace-worthy logs, I'll have to use ETW and the EventSource class is better equipped for that.

Stobber
  • 162
  • 2
  • 12
0

You don't need an API - it's built in to .Net. Consider TraceSource and the EventLogTraceListener. You can apply filters to message types to send only those messages which are 'event log worthy' to the event log, and use ETW and custom trace listeners to capture transient debug data. Reconfiguration can be done at runtime to help with debugging. Also an upside - there are a ton of TraceSources built in to the .net framework.

See this SO answer, and this blog post for more on why TraceSource is a good option

Community
  • 1
  • 1
Josh
  • 4,009
  • 2
  • 31
  • 46