My windows service writes to the event log, but I've had various problems getting this correct. So in the process I used a number of different names. I followed an article describing how to set up event logs in windows services. So after adding an EventLog component in the designer, I have added this to the constructor:
if (!System.Diagnostics.EventLog.SourceExists("AS0604"))
System.Diagnostics.EventLog.CreateEventSource("AS0604", "SIRR");
eventLog1.Source = "AS0604";
eventLog1.Log = "SIRR";
eventLog1.WriteEntry("AS is initializing...", EventLogEntryType.Information, 16);
I found out that there is trouble if the source has the same name as the service name of the windows service. But I kept changing the names a lot for both the Log and the Source. The
EventLog[] eventLogs = EventLog.GetEventLogs();
Lists the eventlogs and I was able to remove those I didn't use with EventLog.Delete command.
But how does this work? Are there still registered sources in these deleted logs? Can I get a list of registered sources?
An event source is the producer of an event or events that are relevant to a monitor model. A remote event source can be a remote cell hosting IBM Business Process Manager or IBM Business Monitor. Events can be sent using the Dynamic Event Framework (new in this release) or Common Event Infrastructure (CEI).
Open "Event Viewer" by clicking the "Start" button. Click "Control Panel" > "System and Security" > "Administrative Tools", and then double-click "Event Viewer" Click to expand "Windows Logs" in the left pane, and then select "Application".
The event source is the name of the software that logs the event. It is often the name of the application or the name of a subcomponent of the application if the application is large.
By default, Event Viewer log files use the . evt extension and are located in the %SystemRoot%\System32\winevt\Logs folder. Log file name and location information is stored in the registry.
Since the accepted answer is lost, here is another. Unfortunately I found no alternative to examining the Windows Registry directly.
PowerShell (Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\<EventLogName>).pschildname
E.g. to list the Windows Application Event Log's Sources:
PowerShell (Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application).pschildname
I threw this up after reading several sources. Unfortunately none were very clear or direct.
I don't have a C# answer, but here is a WMI solution:
$Sources = Get-WmiObject -Namespace "root\cimv2" -Class "Win32_NTEventLOgFile" | Select-Object FileName, Sources | ForEach-Object -Begin { $hash = @{}} -Process { $hash[$_.FileName] = $_.Sources } -end { $Hash }
This will list the source even if there is no entry currently in the log for the given source.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With