Windows Event Log - how to register an event source?

16

votes

I am creating a new event source and logging a message using the code below:

    static void Main(string[] args)
    {
        if (!EventLog.SourceExists("My Log"))
        {
            EventLog.CreateEventSource("My Application", "My Log");
            Console.WriteLine("Created new log \"My Log\"");
        }

        EventLog myLog = new EventLog("My Log");
        myLog.Source = "My Application";
        myLog.WriteEntry("Could not connect", EventLogEntryType.Error, 1001, 1);
    }

A custom event log with the name "My Log" is created (as expected) but the message is logged below the "Application" node. What am I doing wrong?

c#.net

22

votes

There's the following note in MSDN:

If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

Is it possible while trying out the code that you previously tried writing to the Application log and you now need to reboot for it to "unmap" that link?

10

votes

You appear to have things mixed up somewhere there I think.

You have a source (which is your application) and that source is linked to a Log, this is done when you Create your source You have mixed these up a little bit at the beginning of your code, it should in fact be

    if (!EventLog.SourceExists("My Application"))

I have just written a little code to help me out of this. source registered in another log issue which I have encountered and don't want to manually have to remove sources from logs. What I decided to do was check if the source exists, if it does check that its linked to the correct log, if it isn't delete the source, now that it doesn't exist or f it never did create the Log brand new.

protected const string EventLogName = "MyLog";

private static bool CheckSourceExists(string source) {
  if (EventLog.SourceExists(source)) {
    EventLog evLog = new EventLog {Source = source};
    if (evLog.Log != EventLogName) {
      EventLog.DeleteEventSource(source);
    }
  }

  if (!EventLog.SourceExists(source)) {
    EventLog.CreateEventSource(source, EventLogName);
    EventLog.WriteEntry(source, String.Format("Event Log Created '{0}'/'{1}'", EventLogName, source), EventLogEntryType.Information);
  }

  return EventLog.SourceExists(source);
}

public static void WriteEventToMyLog(string source, string text, EventLogEntryType type) {      
  if (CheckSourceExists(source)) {          
      EventLog.WriteEntry(source, text, type);          
  }
}

Hopefully it helps :)

Windows Event Log - how to register an event source?

2 Answers