30

I am trying to use eventlogs in my application using C#, so I added the following code

if (!EventLog.SourceExists("SomeName"))
EventLog.CreateEventSource("SomeName", "Application");

The EventLog.SourceExists causes SecurityException that says
"The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security."

I am running as administrator in Windows 7.

Any help would be appriciated.

user850010
  • 6,311
  • 12
  • 39
  • 60
  • Seems to work fine for me. Are you running Visual Studio or the program output (.exe) as administrator, i.e., right-click, run as administrator? – mellamokb Jul 18 '11 at 16:23
  • I am not running Visual Studio as administrator. I guess that was the problem. Running the .exe application as administrator also solves the problem. – user850010 Jul 18 '11 at 18:25

4 Answers4

18

This is a permissions problem - you should give the running user permission to read the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog

Alternaitvely you can bypas the CreateEventSource removing the need to access this registry key.

Both solutions are explained in more detail in the following thread - How do I create an Event Log source under Vista?.

Justin
  • 84,773
  • 49
  • 224
  • 367
11

Yes, it's a permissions issue, but it's actually worse than indicated by the currently accepted answer. There are actually 2 parts.

Part 1

In order to use SourceExists(), the account that your code is running under must have "Read" permission for the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog key and it must also have "Read" permissions on each of the descendant-keys. The problem is that some of the children of that key don't inherit permissions, and only allow a subset of accounts to read them. E.g. some that I know about:

  • Security
  • State
  • Virtual Server

So you have to also manually change those when they exist.

FYI, for those keys (e.g. "State") where even the Administrator account doesn't have "Full Access" permission, you'll have to use PsExec/PsExec64 to "fix" things. As indicated in this StackOverflow answer, download PsTools. Run this from an elevated command prompt: PsExec64 -i -s regedit.exe and you'll them be able to add the permissions you need to that key.

Part 2

In order to successfully use CreateEventSource(), the account that your code is running under must have "Full Control" permissions on HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog as well as have "Full Control" permissions on the log you're adding the new source to.

But wait, there's more...

It is also important to know that both CreateEventSource() and WriteEntry() call SourceExists() "under the hood". So ultimately, if you want to use the EventLog class in .Net, you have to change permissions in the registry. The account needs "Full Control" on the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog key and "Read" for all children.

Commentary: And I believe all of this mess is because when Microsoft originally designed the EventLog, they decided it was critical that people would be able to log something by "Source" without needing to know what log that "Source" went with.

Granger
  • 3,639
  • 4
  • 36
  • 34
3

Short tip:

One event source is registered during Service instalation (if application is Windows Service), and can be used without Security Exception with low-profile process owner (not Administrator)

I perform service installation / run with C# code in typical way from SO/ MSDN

Important is property ServiceName in class System.ServiceProcess.ServiceBase .

Jacek Cz
  • 1,872
  • 1
  • 15
  • 22
  • Why or how `ServiceName` is an important property? Is it used as the Event Log Source name as well? – Adam L. S. Jan 27 '18 at 20:07
  • Creating new "event source" from ordinary application can be blocked by rights system etc. I guess during installation this one event source is magically created (???) – Jacek Cz Jan 29 '18 at 08:44
  • @JacekCz The `ServiceInstaller`'s class constructor adds an `EventLogInstaller` to its inner `.Installers` collection. This "hidden" `EventLogInstaller` has the same `Source` value as `ServiceInstaller.ServiceName`. – Dai Jul 06 '18 at 02:54
  • Three additional notes on this- 1) The auto-creation of the log source can still fail if the installation is not completed with sufficient privileges. 2) The auto-generated code for creating the log source always uses the Application log, so you have to modify the auto-generated code, or add code if you want to use a custom log for your service (we do this to avoid potentially cluttering the Application log). 3) A log source can only be associated with one log, so if you use both the Application log and a custom log, you have to register two separate, and unique, log sources. – Eric Aug 16 '21 at 17:10
0

Good afternoon, The simplest is that you run vs2019 as an administrator, so when debugging or excute the service, it will run correctly without generating the exception.

Ronaldo Moreira
  • 1,007
  • 7
  • 3