Writing to event log in C# - do I need to use EventLog.CreateEventSource when writing to Application log?

Question

When I use the following code to write to Application Event log, everything works fine:

EventLog log = new EventLog();
log.Source = "Application";
log.WriteEntry("test message", EventLogEntryType.Error);

When I use the code that is from MSDN and all other blogs, I get the security error (I am guessing because CreateEventSource raises it).

string sSource = "MyWebService";
string sLog = "myApplication";
string sMsg = errorMessage;

if (!EventLog.SourceExists(sSource))
   EventLog.CreateEventSource(sSource, sLog);

 EventLog.WriteEntry(sSource, sMsg, EventLogEntryType.Error);  

So, do I need to check whether the source exists if all I need is to write to Application log which is there by default?

What is the proper way to write to EventViewer?

Fino

Answer 1

The CreateEventSource method create a new source in the event log, this allow you to write log of your application in the application own group instead of writing in the generic Application group.

Maybe you get an error because the user that you using to create the event source doesn't have the permission to create it, try to run your program as administrator if you are under Vista/7 OS.

The proper way to log in the event viewer depends on your needs, if your application generates a lot of logging message and you want to group this log in an application specific container, maybe it is better to create an application specific log event source and write the log in it, instead if your application generates few log messages and there is no need to group them together you can use the the generic Application log event source ...

Rosenquist

great, thanks!I just needed to confirm. I don't need to create a separate source/log. I actually do want to write to the Application log. – Fino

one more question: when I write to the generic Application source, I get the following message when viewing it in the event viewer: "The description of Event(0) is Source(Application) can not be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer"....then my custom message is displayed. I was wondering if it is possible to not display this long default message w/o setting the source. – Fino

Its because your monitoring computer doesnt have references to error msg's, export the remote machine eventlog to textbased CSV file and you get all the info from a remote machine (includding errors of all the apps the other people have installed). – Cle

Answer 2

I suggest you try log4net, in case you want to write to different sources as well (smtp, file, etc.)

http://logging.apache.org/log4net/release/config-examples.html#eventlogappender

For web apps:

• http://haacked.com/archive/2005/03/07/ConfiguringLog4NetForWebApplications.aspx

General use:

• http://mitch-wheat.blogspot.com/2007/04/log4net-net-logging-tool.html

Similar solution for winforms/windows service.

Trull

Thanks, but this doesn't answer the question asked. – Fino

Answer 3

You need to have admin rights to create an event source. In the first one you are not using a custom source.

Keeling

Answer 4

A straight WriteEntry will go to the default Application source. The SourceExists and CreateEventSource is if you want to create your own custom source which will be easier to locate any log entries in the Event Viewer.

And yes you need to have rights to create a customer event source as others have mentioned.

Dominy

Answer 5

You need admin rights to run your application.

Either you can run your application by Going into the debug folder of your application and right click on your .exe file and run as admin

or

You run Visual studio as admin

Curcio

Answer 6

You don't need to create an event source. It can be a big advantage when generating events that are language-independent or that have substitutions, but it's optional, at least for .NET programs (the BCL provides a default event source).

Suber

you get the error "Source property was not set before writing to the event log" when Log is empty, so no, it's not optional. – Deepen