Windows Forms Event Log

Question

I am writing to the event log from my Windows Forms application running on Windows 7 and am getting this message in the event log:

The description for Event ID X from source Application cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

Exception Details

the message resource is present but the message is not found in the string/message table

My logging code is:

public void Log(Exception exc)
{
    EventLog.WriteEntry(
        "Application", 
        exc.ToString(), 
        EventLogEntryType.Error, 
        100);
}

My logging on Windows Forms is usually to a DB, but in this case decided to use the event log. I usually use the event log in ASP.NET applications, but those are on XP Pro locally and Windows Server 2003 on the web boxes.

Is this a Windows 7 thing or a Windows Forms thing, and what should I do to fix this? Thanks.

Answer 1

See http://support.microsoft.com/kb/307024, specifically, don't forget to create your event source.

Answer 2

The first parameter in this overload is "The source by which the application is registered on the specified computer." documented here If this source is, as in your case, "Application" you get this behavior. (Could it be that you mistakingly think the 1st parameter refers to the Windows Log : Application, Security, etc ?)

To register your source do this :

public void Log(Exception exc){
    if(!EventLog.SourceExists("MySource"))
    {
        EventLog.CreateEventSource("MySource", "MyNewLog");
        return ;
    }
    EventLog.WriteEntry(
     "MySource", 
     exc.ToString(), 
     EventLogEntryType.Error, 
     100); }  

Answer 3

This solution was working for me:

In the registry of windows 7 or Win 2008 R2 there is a key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\CustomEventLog under this key are all the registered valid sources for that event log.

When you try and write to an Event log with a source that isn’t a valid (isn’t a key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\CustomEventLog) it enumerates the other Event logs keys to see if there source exists there.

I added all missing sources under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\CustomEventLog key. Just create a copy of existing keys under this key and rename it to your EventSource.