Adding an Event Log to a Windows Service

Greetings,

I have a Service (seen in the code below) which I'm trying to add an Event Log for.  Could use help with the EvtLog_EntryWritten(...) event.

1)  Not sure what to put in the event
2)  Is there a way I can test this or force an event?

I'm guessing that a try/catch is what makes use of the Event log.  Thus, is it the catch that triggers EvtLog_EntryWritten(...) ?

Thanks
public partial class RegCheckService : ServiceBase
    {        
        public RegCheckService()
        {
            ServiceTimer.Enabled = true;
 
            if (!EventLog.SourceExists(EvtLog.Source))
                    EventLog.CreateEventSource(EvtLog.Source, EvtLog.Log);
 
            InitializeComponent();
                       
            return;
        }
 
 
        protected override void OnStart(string[] args)
        {
            ServiceTimer.Start();
        }
 
        protected override void OnStop()
        {
            ServiceTimer.Stop();
        }
 
        private void ServiceTimer_Tick(object sender, EventArgs e)
        {
            // Check Registry 
        }
       private void EvtLog_EntryWritten(object sender, EntryWrittenEventArgs e)
        {
 
        }
 
     }

Open in new window

John500Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

WoodzCommented:
It looks like EvtLog_EntryWritten is a callback method to be used in an EntryWrittenEventhandler delegate, to be wired up to the EventLog.EntryWritten event to perform some action when an event is written to your custom event log. If this is the case, unless ServiceBase has the code for this to happen, you will need to do this in the constructor (see code below).

Once EvtLog_EntryWritten is subscribing to the EntryWritten event, it will be invoked when an event is written to the event log (time constraints aside - this occurs a maximum of once every 6 seconds). In this method, perform whatever action you are required to do on an event write, using the EventLogEntry EventWrittenEventArgs.Entry property to access the data about the last written event.

Testing is simple - with your service running with the method wired up to the EntryWritten event, run a simple program that simply has a call to EventLog.WriteEntry, with the matching event source and log name as your service. This will fire the event, calling back into your code.
public partial class RegCheckService : ServiceBase
    {        
        public RegCheckService()
        {
            ServiceTimer.Enabled = true;
 
            if (!EventLog.SourceExists(EvtLog.Source))
                    EventLog.CreateEventSource(EvtLog.Source, EvtLog.Log);
 
            InitializeComponent();
 
            // Wire up callback method
            EventLog.EnableRaisingEvents = true;
            EventLog.EntryWritten += new EntryWrittenEventHandler(EvtLog_EntryWritten);
                       
            return; // DO NOT NEED in constuctor
        }
 
 
        protected override void OnStart(string[] args)
        {
            ServiceTimer.Start();
        }
 
        protected override void OnStop()
        {
            ServiceTimer.Stop();
        }
 
        private void ServiceTimer_Tick(object sender, EventArgs e)
        {
            // Check Registry 
        }
       private void EvtLog_EntryWritten(object sender, EntryWrittenEventArgs e)
        {
 
        }
 
     }

Open in new window

0
John500Author Commented:
>>  It looks like EvtLog_EntryWritten is a callback method to be used in an EntryWrittenEventhandler delegate

So then, you agree that within my RegCheck class I would have something like:

public class RegCheck
{

        private EventWriter EvtLog_EntryWritten = null;
        public delegate void EventWriter(string buffer);


        public void RunRegUpdate()
        {
               ...
               ...
               try
               {
                         MyTestRegKey = Microsoft.Win32...OpenSubkey(@"SOFTWARE\.......);
               }
               catch(Exception exe
               {
                       this.WriteEvent("***** + exe.Message + "\n" + exe.StackTrace);
               }
               ...
         }
}

 
Does this all look right?
Thanks!


         
    public partial class RegCheckService : ServiceBase
    {
 
        private RegCheck RC = null;
        public string buffer = string.Empty;
        private bool _Debug = true;        
 
        public RegCheckService()
        {
            ServiceTimer.Enabled = true;
            ServiceTimer.Start();
            if (!EventLog.SourceExists(EvtLog.Source))
                    EventLog.CreateEventSource(EvtLog.Source, EvtLog.Log);
 
            // Wire up callback method
            EventLog.EnableRaisingEvents = true;
            EventLog.EntryWritten += new EntryWrittenEventHandler(EvtLog_EntryWritten);
 
            InitializeComponent();
   
        }
 
 
        protected override void OnStart(string[] args)
        {
            EvtLog.WriteEntry((_Debug ? "[DEBUG ENABLED]\r\n)" : "") + "RegistryCheck service starting.\r\n", EventLogEntryType.Warning);
            ServiceTimer.Start();
        }
 
        protected override void OnStop()
        {
            ServiceTimer.Stop();   // Stop OR Dispose?
            EvtLog.Dispose();      // Dispose RIGHT ?
        }
 
        private void ServiceTimer_Tick(object sender, EventArgs e)
        {
            RC.RunRegUpdate();
        }
 
        private void EvtLog_EntryWritten(object sender, EntryWrittenEventArgs e)
        {
            EvtLog.WriteEntry(buffer, EventLogEntryType.Information);
        }
 
 
    }

Open in new window

0
WoodzCommented:
I am really not sure what you are trying to do with the EntryWritten event - this is raised after the event has been written to the event log - you do not need to write the event to the log manually. The EntryWritten event would be used by monitoring or alert software to visually display or send a network message to inform someone of the fact that the event log has had an event written to it, it is not used to write to the log - this would lead to an infinite loop - write to log, event fired, write to log, event fired, etc... In C# the EventLog class encapsulates all the aspects of writing events to an event log - so you do not need to worry about using buffers, etc., to write to the log. For the majority of uses, custom event logs should be as simple as:

- Check if custom event log source exists, create if not,
- Write to custom event log when required.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
John500Author Commented:
Terrific, now I understand the code which was used by a previous developer.

Thanks!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
.NET Programming

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.