4

I'm trying to get my .Net Windows Service to right to a custom event log. I'm using EventLogInstaller to create the event log and source when the application is installed. I read here that it takes a while for Windows to register the source so they reccomend you restart the application before trying to write to the log.

As this is a Windows Service I didn't want to have to force a computer restart or get the user to manually start the service up, so I use this code to wait for the log to exist and then start the service automatically.

while (!(EventLog.Exists("ManageIT") || EventLog.SourceExists("ManageIT Client Service")))
{
    Thread.Sleep(1000);
}

System.ServiceProcess.ServiceController controller = new System.ServiceProcess.ServiceController("ManageIT.Client.Service");
controller.Start();

My problem is that events from the service are still written to the Application Log and although I can see my custom log in the Registry Editor it does not show up in the Windows 7 Event Viewer.

Any help will be much appreciated.

Improve this question
5
  • 1
    Did you ever solve this problem? I have the same thing happening here. Commented Oct 28, 2010 at 3:09
  • Yeah, so have I. And I'm getting furious. Commented Jan 14, 2015 at 12:49
  • Possible duplicate of Write to Windows Application Event Log Commented Jun 12, 2019 at 14:59
  • @Liam probably but I asked before that one :) Commented Nov 23, 2021 at 22:10
  • Who asked first isn't really important. It's more about which question has the best answers, etc. Commented Nov 24, 2021 at 8:55

4 Answers 4

Reset to default
6

By default when a service is installed, the source gets associated with the Application Log. If we change this association at a later point, the system needs a restart.

We can however prevent the association of the service with the application log, by setting autolog property to false in the service class (class which inherits from servicebase) constructor. http://msdn.microsoft.com/en-us/library/system.serviceprocess.servicebase.autolog.aspx

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

This was the answer for me. I improperly created the log under Application, I removed and re-created it properly but it still wrote to application. I re-boot straightened it out.
4

Try this snippet:

edit - caveat: if the user running the code does not have administrator rights, this will throw an exception. Since this is the case (and if the user will not have these rights) best practices should be to assume the log exists, and simply write to it. see: The source was not found, but some or all event logs could not be searched

if (!EventLog.SourceExists("MyApplicationEventLog"))
{
    EventSourceCreationData eventSourceData = new EventSourceCreationData("MyApplicationEventLog", "MyApplicationEventLog");
    EventLog.CreateEventSource(eventSourceData);
}

using (EventLog myLogger = new EventLog("MyApplicationEventLog", ".", "MyApplicationEventLog"))
{
    myLogger.WriteEntry("Error message", EventLogEntryType.Error);
    myLogger.WriteEntry("Info message", EventLogEntryType.Information);
}
Improve this answer

5 Comments

Thats just a standard way of writing to the eventlog. My problem is that even though I have a custom eventlog created. The events I write still go into the application log, not my custom one. Even when using EventLog eventLog = new EventLog("ManageIT"); eventLog.Source = "ManageIT Client Service";
@Marko, although already approved, I honestly feel the edit should be a comment or another answer. This is not the first nor the last "bad" answer accepted on a question. Just because a question has an accepted answer, it does not make it not answerable.
@Khez I'm tagged with the edit because I reviewed somebody else's edit and make it clear what had been added - although I agree there is a case for this being a comment.
Thought for sure I wrapped that in the standard edit [/edit] brackets, but I guess not. thx for fixing that.. I edited the answer because I was unable to add a comment, and adding another duplicated answer with only an additional caveat that would most likely not be marked the answer since it's so old seemed like a dumb idea, and probably be met with folks complaining I should have edited the answer (has happened before)..
Concentrate on TheDuke's problem (first comment) guys, because I'm also facing that now. Thanks.
1

It sounds like you are writing to the event log like this:

 EventLog.WriteEntry("Source", "Message");

This will write to the application log.

If you use the code in simons post with the creation of myLogger, you can specify the name of the Log.

Improve this answer

Comments

0

I did something like this:

        var logName = EventLog.LogNameFromSourceName("MyApp", Environment.MachineName);

         //delete the source if it associated with the wrong Log
        if (!string.IsNullOrEmpty(logName) & logName != "MyLog")
        {
            EventLog.DeleteEventSource("MyApp", Environment.MachineName);
        }

        if (!EventLog.SourceExists("MyApp"))
        {
            EventLog.CreateEventSource("MyApp", "MyLog");
        }
Improve this answer

2 Comments

the act of calling EventLog.SourceExists causes the OS to enumerate available logs, and when it hits the 'Security' log, you'll get an error for a non-elevated user
Good to know. Thanks! I have not ran into that as of yet because the service accounts we have do have elevated privileges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.