How to write to Windows Event Viewer Application Channel? (.NET)

Question

I am able to log to Windows Event Viewer using Serilog. However, it logs to Windows Logs / Application. I wish to log to Applications and Service Logs. I think I need to create a custom channel and then config the logger to send to that custom channel.

https://learn.microsoft.com/en-us/previous-versions/bb756956(v=msdn.10)?redirectedfrom=MSDN I think this custom channel is an application channel. When I research application channel the results always end up Application Insights. I am not using Azure. Just IIS.

Here is my C# code. Any Suggestions?

          Log.Logger = new LoggerConfiguration().MinimumLevel.Debug()
                      .WriteTo.EventLog("Laserfiche_Document_Finder", 
                       manageEventSource: true).CreateLogger();

            builder.Host.UseSerilog();
            

            "Serilog": {
        "using": [ "Serilog.Sinks.EventLog" ],
        "Minimumlevel": {
          "Default": "Information"
        },
        "WriteTo": [
          {
            "Name": "EventLog",
            "Args": {
              "source": "DLF",
              "manageEventSource": true
            }
          }
        ]

I think this question https://stackoverflow.com/questions/446691/how-to-create-windows-eventlog-source-from-command-line has the answer i am looking for. I will try this tomorrow. — It's Just a Printer Driver, Sep 20 '22 at 21:45

score 0 · Accepted Answer · answered Sep 21 '22 at 14:32

The namespace System.Diagnostics provides a class name as “EventLog” to create and write a message into the eventlog.

Let’s take an example, our goal is to write a simple C# .NET class which will create a new log name as “myEventLog” and write a message “I will not say I have failed 1000 times; I will say that I have discovered 1000 ways that can cause failure – Thomas Edison.” as an information.

To achieve this, we need to use the following methods, properties and enum which will be found in the System.Diagnostics namespace.

SourceExists: Determines whether an event source is registered on the local computer or not.

CreateEventSource: Establishes an application as able to write event information to a particular log on the system. More details can be found at this link.

WriteEntry: Writes an entry in the event log, i.e., writes an information type entry, with the given message text, to the event log. More details can be found at this link.

public class ClsEventLog
{
  public bool CreateLog(string strLogName)
  {
      bool Result = false;

      try
      {
              System.Diagnostics.EventLog.CreateEventSource(strLogName, strLogName);
              System.Diagnostics.EventLog SQLEventLog =
          new System.Diagnostics.EventLog();

              SQLEventLog.Source = strLogName;
              SQLEventLog.Log = strLogName;

              SQLEventLog.Source = strLogName;
              SQLEventLog.WriteEntry("The " + strLogName + " was successfully
      initialize component.", EventLogEntryType.Information);

              Result = true;
      }
      catch
      {
          Result = false;
      }

      return Result;
  }
  public void WriteToEventLog(string strLogName
                            , string strSource
                            , string strErrDetail)
  {
      System.Diagnostics.EventLog SQLEventLog = new System.Diagnostics.EventLog();

      try
      {
          if (!System.Diagnostics.EventLog.SourceExists(strLogName))
                  this.CreateLog(strLogName);


          SQLEventLog.Source = strLogName;
          SQLEventLog.WriteEntry(Convert.ToString(strSource)
                                + Convert.ToString(strErrDetail),
          EventLogEntryType.Information);

      }
      catch (Exception ex)
      {
          SQLEventLog.Source = strLogName;
          SQLEventLog.WriteEntry(Convert.ToString("INFORMATION: ")
                                + Convert.ToString(ex.Message),
          EventLogEntryType.Information);
      }
      finally
      {
          SQLEventLog.Dispose();
          SQLEventLog = null;
      }
  }
}

Oliver Beck · Answer 2 · 2022-09-20T23:12:42.247

-1

I think you have to set Log level explicite for EventLog.

EventLog provider does not inherit the default non-provider settings. If EventLog log settings aren't specified, they default to LogLevel.Warning.

"Logging": {
  "EventLog": {
    "LogLevel": {
      "Default": "Information"
    }
  }
}

see https://learn.microsoft.com/de-de/aspnet/core/fundamentals/logging/?view=aspnetcore-6.0#windows-eventlog

edited Sep 20 '22 at 23:12

answered Sep 20 '22 at 23:06

Oliver Beck

61
3

That ends up writing an event to Windows Logs - Application. To create a custom event log I found. System.Diagnostics.EventLog.CreateEventSource(strLogName, strLogName); – It's Just a Printer Driver Sep 21 '22 at 16:02

How to write to Windows Event Viewer Application Channel? (.NET)

2 Answers2