?
Solved

writing to eventlog

Posted on 2006-05-02
15
Medium Priority
?
1,192 Views
Last Modified: 2012-05-05
I've written a Windws Service that writes to an EventLog.

I can create my own event log, but whatever I do, I seem only to write to the Application Eventlog.

Any clues?
0
Comment
Question by:broadbent
  • 6
  • 3
  • 3
  • +2
14 Comments
 
LVL 143

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 16590984
0
 
LVL 15

Expert Comment

by:igor_alpha
ID: 16593267
Hi angelIII,

I'am use following method to log messages to custom log

using System.Diagnostics;

public static void Write(Exception e, string source, string misc)
        {

            if(!EventLog.Exists("LogName"))
            {
                System.Diagnostics.EventLog.CreateEventSource("LogSource", "LogName");
            }

            EventLog log = new EventLog("LogName");
            log.Source = "LogSource";
            string msg = e.Message + "\n" + "Source: " + e.Source + " / " + source;
            if (misc != "") msg += "\n" + misc;
            log.WriteEntry(msg,EventLogEntryType.Error);
        }

You can encounter some problems, beacuse when you try to write to custom event log,
the API tries to create the approproate registry entry. So, you need to call EventLog.CreateEventSource
from an administrative account first.
0
 
LVL 4

Author Comment

by:broadbent
ID: 16593978
I've done all this, and indeed created my custom log.
But it still writes to the Application Eventlog.
0
Free Backup Tool for VMware and Hyper-V

Restore full virtual machine or individual guest files from 19 common file systems directly from the backup file. Schedule VM backups with PowerShell scripts. Set desired time, lean back and let the script to notify you via email upon completion.  

 
LVL 15

Expert Comment

by:igor_alpha
ID: 16600869
Can you show your code?
0
 
LVL 4

Author Comment

by:broadbent
ID: 16603910
code:
            If Not EventLog.Exists("OM") Then
                  If EventLog.SourceExists("OMService") Then EventLog.DeleteEventSource("OMService")
                  EventLog.CreateEventSource("OMService", "OM")
            End If
            OMLog = New System.Diagnostics.EventLog
            With OMLog
                  .Log = "OM"
                  .MachineName = Environment.MachineName
                  .Source = "OMService"
                  .WriteEntry("Service Starting", EventLogEntryType.Information, 300)
            End With

The event OM exists, but is empty.
the Application eventlog contains the following:
Event Type:      Success Audit
Event Source:      OMService
Event Category:      None
Event ID:      301
Date:            04/05/2006
Time:            10:22:11
User:            N/A
Computer:      STUART
Description:
The description for Event ID ( 301 ) in Source ( OMService ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Service Stopped.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 16607407
1) Does the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog show the new source name that you created?

2) The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application key has a Sources value.  Is your application listed in this value?

Bob

0
 
LVL 4

Author Comment

by:broadbent
ID: 16607559
  The Custom Log OM is shown on Computer Management.

1. It does show under HKLM etc. and has 2 keys under it
      OM & OMService each of which contains String Value "EventMessageFile" with value "C:\Windows... EventLogMessage.dll"
2. NO.

   There is a key for OMService under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
   which has two sub-keys ENUM & SECURITY
0
 
LVL 15

Expert Comment

by:igor_alpha
ID: 16610451
1. Check permissions on Custom Log OM key. Set permissions same as Application key.
2. Is EventMessageFile exist? Registry link possible point to to location with wrong .net framework version.
3. I'm not sure, but possibly problem in same source "OMService" in application log. Try to remove such source from application log first.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 16633660
What is the user context for the Windows service?

Bob
0
 
LVL 4

Author Comment

by:broadbent
ID: 16637619
A few interesting things happened.
For no reason, the log started to write. This happened after a reboot.
The next thing that happened was that I got the message that my VS2005 Beta trial had run out and so I removed it and I also removed the SDK2.
I then needed to modify the code and so I then discovered that the version of InsatllUtil needed changing, which I did and then I managed to install the service, but guess what?
The Custom Log is broke.
0
 
LVL 4

Author Comment

by:broadbent
ID: 16637664
And then I tried rebooting, and guess what?
It now works!

The code is very standard. So is it my machine or environment? Will it work on other machines?

One thing, I discovered that I needed
               If EventLog.SourceExists("OMService") Then EventLog.DeleteEventSource("OMService")
               EventLog.CreateEventSource("OMService", "OM")
because I added
Try
          With OMLog
               .Log = "OM"
               .MachineName = Environment.MachineName
               .Source = "OMService"
               .WriteEntry("Service Starting", EventLogEntryType.Information, 300)
          End With
Catch ex as Exception
and here the .writeentry created an exception
"The source 'OMService' is not registered in log 'OM'. (It is registered in 'Application'.)
The Source and Log properties must be matched" etc
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 16638477
>>So is it my machine or environment? Will it work on other machines?
Tough to comment on that.  It sounds like a machine problem, but it's difficult to narrow it down, other than installing and running on different platform types.

Bob
0
 
LVL 4

Author Comment

by:broadbent
ID: 16706922
I believe the answer is that you need to reboot the machine for the service to use the user-defined eventlog.
0
 

Accepted Solution

by:
GranMod earned 0 total points
ID: 16968228
PAQed with points refunded (250)

GranMod
Community Support Moderator
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A basic question.. “What is the Garbage Collector?” The usual answer given back: “Garbage collector is a background thread run by the CLR for freeing up the memory space used by the objects which are no longer used by the program.” I wondered …
More often than not, we developers are confronted with a need: a need to make some kind of magic happen via code. Whether it is for a client, for the boss, or for our own personal projects, the need must be satisfied. Most of the time, the Framework…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Whether it be Exchange Server Crash Issues, Dirty Shutdown Errors or Failed to mount error, Stellar Phoenix Mailbox Exchange Recovery has always got your back. With the help of its easy to understand user interface and 3 simple steps recovery proced…
Suggested Courses
Course of the Month15 days, 10 hours left to enroll

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question