1

I have a small winforms app that creates a new event log source.

I run it as administrator for the elevated privileges.

The code checks to ensure the specified event log does not exist and then creates the source. This worked fine on my Windows 7 machine, but when I run the app on Windows Server 2008 R2 SP1 it tells me the source already exists. I know it doesn't because a) this is a fresh installed of Windows Server 2008 R2, and b) I added code to return a list of all the log sources and my new one was not in the list.

I know about the "first 8 characters" being the significant ones and I made sure my source names was completely unique.

Here's the super-easy code (of course I have try/catches around this):

if (!EventLog.SourceExists(sourceName))
{
    EventLog.CreateEventSource(sourceName, logName);
}

Can anyone tell me why Windows Server 2008 is lying to me?

Aaronster
  • 1,764
  • 2
  • 14
  • 11

1 Answers1

0

Local (or domain) administrators are not the most powerful accounts on a Windows box.

There are other accounts that have higher (though also more limited) access.

SourceExists() will return false if it exits but you don't have access rights to know about it, and it's perfectly possible for an administrator to be denied access to something.

Also, there are reserved names for things in odd places that can trip you up. Creating folders with the names CON COM or LPT used to cause odd issues on server 2003.

So there also are a whole bunch of reasons why CreateEventSource() can fail - dig into the inner exception(s) as well, often those provide critical detail.

Which event log source name was failing for you?
Would you post the exception stack?

Bevan
  • 43,618
  • 10
  • 81
  • 133
  • Strange. I just tried it again with a source name guaranteed to be unique ("Oct12") and it worked! I have no idea what was happening last night. It seems as though the source I _thought_ didn't exist actually existed. Maybe it matched the registered name of the corresponding windows service. Here's the exception: `Source PPTConversionService already exists on the local computer. at System.Diagnostics.EventLog.CreateEventSource(EventSourceCreationData sourceData) at System.Diagnostics.EventLog.CreateEventSource(String source, String logName) at EventLogJuicer.Form1.CreateSource()` – Aaronster Oct 10 '11 at 14:09
  • The event log I just created isn't appearing in the Applications and Service logs event log list... restarting Server Manager... there it is! It's working now. Go Figure. – Aaronster Oct 10 '11 at 14:20