Is it acceptable to write to the Application Event Source?

Question

There are certain circumstances in our application where non-fatal errors occur and the application recovers.

An example of this failing to correctly identify some importable items when populating said items to a selection list. The errors won't crash the app but a user would be alerted that some of the items failed to load.

In this case, the error is logged to the Application event log as a warning. It's a non-fatal error that the app recovers from, but logging to the event log allows us to see the original error if need be.

Our problem is that the software needs to be able to be installed with a Power User account. Not being an admin account, we won't have the ability to create custom event sources for the application.

The aim is to write the errors instead to the "Application" event source (which already exists appears in the Application event log). Doing this, however, causes text similar to the following to also be included.

The description for Event ID 0 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

This is because the EventID is 0 when we write it. This approach will get the job done, but is there a a better way? Is there a non-admin way to specify the EventID for the Application Event source to indicate that it came from our app?

Answer 1

You are able to pass the Application Event ID as a parameter: ( example : 234 )

EventLog.WriteEntry("Application", "your log message here", EventLogEntryType.Warning,  234);

Further reading into EventLog.WriteEntry Method

http://msdn.microsoft.com/en-us/library/xzwc042w.aspx

Answer 2

The error you see as The description for Event ID 0 from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer. is the result of the Application source's registered event message file not having an entry for event id 0. The message you see is the result of getting the template for the message id from the event message file and formatting it with the event payload.

I would not recommend in general that you hijack a source you don't own. Whoever is consuming those events has specific expectations about what they mean and what information they carry.

Regarding Is there a non-admin way to specify the EventID for the Application Event source to indicate that it came from our app?, what do you expect that event id specification would mean? The source is what determines where the event came from.

EDIT:

You will get the error in event viewer regardless of whether you provide an event id other than 0, because that source does not have an event message file registered. And even if it did, you would either have to use event ids that have an entry in the message file (confusing the consumers of the events) or event ids that do not have an entry and still get the error.