How to write to a custom event log?

Question

I'm trying to get my .Net Windows Service to right to a custom event log. I'm using EventLogInstaller to create the event log and source when the application is installed. I read here that it takes a while for Windows to register the source so they reccomend you restart the application before trying to write to the log.

As this is a Windows Service I didn't want to have to force a computer restart or get the user to manually start the service up, so I use this code to wait for the log to exist and then start the service automatically.

while (!(EventLog.Exists("ManageIT") || EventLog.SourceExists("ManageIT Client Service")))
{
    Thread.Sleep(1000);
}

System.ServiceProcess.ServiceController controller = new System.ServiceProcess.ServiceController("ManageIT.Client.Service");
controller.Start();

My problem is that events from the service are still written to the Application Log and although I can see my custom log in the Registry Editor it does not show up in the Windows 7 Event Viewer.

Any help will be much appreciated.

Did you ever solve this problem? I have the same thing happening here. — Rohan West, Oct 28 '10 at 03:09
Possible duplicate of [Write to Windows Application Event Log](https://stackoverflow.com/questions/25725151/write-to-windows-application-event-log) — Liam, Jun 12 '19 at 14:59
Who asked first isn't really important. It's more about which question has the best answers, etc. — Liam, Nov 24 '21 at 08:55

score 6 · Answer 1 · answered Jun 27 '13 at 05:54

6

By default when a service is installed, the source gets associated with the Application Log. If we change this association at a later point, the system needs a restart.

We can however prevent the association of the service with the application log, by setting autolog property to false in the service class (class which inherits from servicebase) constructor. http://msdn.microsoft.com/en-us/library/system.serviceprocess.servicebase.autolog.aspx

answered Jun 27 '13 at 05:54

Madhulika

283
3
11

This was the answer for me. I improperly created the log under Application, I removed and re-created it properly but it still wrote to application. I re-boot straightened it out. – Mark Mar 12 '15 at 01:53

score 4 · Accepted Answer · edited May 23 '17 at 12:19

4

Try this snippet:

edit - caveat: if the user running the code does not have administrator rights, this will throw an exception. Since this is the case (and if the user will not have these rights) best practices should be to assume the log exists, and simply write to it. see: The source was not found, but some or all event logs could not be searched

if (!EventLog.SourceExists("MyApplicationEventLog"))
{
    EventSourceCreationData eventSourceData = new EventSourceCreationData("MyApplicationEventLog", "MyApplicationEventLog");
    EventLog.CreateEventSource(eventSourceData);
}

using (EventLog myLogger = new EventLog("MyApplicationEventLog", ".", "MyApplicationEventLog"))
{
    myLogger.WriteEntry("Error message", EventLogEntryType.Error);
    myLogger.WriteEntry("Info message", EventLogEntryType.Information);
}

edited May 23 '17 at 12:19

Community

1
1

answered May 23 '10 at 18:19

sventevit

4,766
10
57
89

2

Thats just a standard way of writing to the eventlog. My problem is that even though I have a custom eventlog created. The events I write still go into the application log, not my custom one. Even when using EventLog eventLog = new EventLog("ManageIT"); eventLog.Source = "ManageIT Client Service"; – TheDuke May 23 '10 at 19:36
@Marko, although already approved, I honestly feel the edit should be a comment or another answer. This is not the first nor the last "bad" answer accepted on a question. Just because a question has an accepted answer, it does not make it not answerable. – Khez Jan 22 '13 at 17:25
@Khez I'm tagged with the edit because I reviewed somebody else's edit and make it clear what had been added - although I agree there is a case for this being a comment. – marko Jan 22 '13 at 17:29
Thought for sure I wrapped that in the standard [edit] [/edit] brackets, but I guess not. thx for fixing that.. I edited the answer because I was unable to add a comment, and adding another duplicated answer with only an additional caveat that would most likely not be marked the answer since it's so old seemed like a dumb idea, and probably be met with folks complaining I should have edited the answer (has happened before).. – JoeBrockhaus Feb 13 '13 at 20:38
Concentrate on TheDuke's problem (first comment) guys, because I'm also facing that now. Thanks. – Mitulát báti Jan 14 '15 at 12:48

score 1 · Answer 3 · answered Aug 11 '10 at 10:48

1

It sounds like you are writing to the event log like this:

 EventLog.WriteEntry("Source", "Message");

This will write to the application log.

If you use the code in simons post with the creation of myLogger, you can specify the name of the Log.

answered Aug 11 '10 at 10:48

Shiraz Bhaiji

64,065
34
143
252

score 0 · Answer 4 · answered Jun 04 '15 at 15:01

0

I did something like this:

        var logName = EventLog.LogNameFromSourceName("MyApp", Environment.MachineName);

         //delete the source if it associated with the wrong Log
        if (!string.IsNullOrEmpty(logName) & logName != "MyLog")
        {
            EventLog.DeleteEventSource("MyApp", Environment.MachineName);
        }

        if (!EventLog.SourceExists("MyApp"))
        {
            EventLog.CreateEventSource("MyApp", "MyLog");
        }

answered Jun 04 '15 at 15:01

dynamiclynk

2,275
27
31

the act of calling `EventLog.SourceExists` causes the OS to enumerate available logs, and when it hits the 'Security' log, you'll get an error for a non-elevated user – bkwdesign Jun 07 '18 at 19:49
Good to know. Thanks! I have not ran into that as of yet because the service accounts we have do have elevated privileges. – dynamiclynk Jun 07 '18 at 19:53

How to write to a custom event log?

4 Answers4