Enterprise Library Logging not logging to Event Log from ASP.NET

Question

I spent a day trying to make Ent Lib Logging work and log anything into database or event log. I have a web application and console application with the same Ent Lib config but only the console application is capable to log into the Event Log. I tried everything with permissions but I don't know what exactly I am doing — which services should have what. It does not work!

I read articles like this http://imar.spaanjaars.com/275/logging-errors-to-the-event-log-in-aspnet-applications and I want to try to give the ASPNET account those permissions. I am using Windows 7 and I cannot find ASPNET user account. So where is it?

This is the config file which is automatically generated from Ent Lib utility and it works only on App.config, not on web.config

<loggingConfiguration name="Logging Application Block" tracingEnabled="true"
    defaultCategory="General" logWarningsWhenNoCategoriesMatch="true"
    revertImpersonation="false">
    <listeners>
      <add source="Logger" formatter="Text Formatter" log="Application"
        machineName="" listenerDataType="Microsoft.Practices.EnterpriseLibrary.Logging.Configuration.FormattedEventLogTraceListenerData, Microsoft.Practices.EnterpriseLibrary.Logging, Version=4.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"
        traceOutputOptions="None" filter="All" type="Microsoft.Practices.EnterpriseLibrary.Logging.TraceListeners.FormattedEventLogTraceListener, Microsoft.Practices.EnterpriseLibrary.Logging, Version=4.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"
        name="Formatted EventLog TraceListener" />
    </listeners>
    <formatters>
      <add template="Timestamp: {timestamp}&#xD;&#xA;Message: {message}&#xD;&#xA;Category: {category}&#xD;&#xA;Priority: {priority}&#xD;&#xA;EventId: {eventid}&#xD;&#xA;Severity: {severity}&#xD;&#xA;Title:{title}&#xD;&#xA;Machine: {machine}&#xD;&#xA;Application Domain: {appDomain}&#xD;&#xA;Process Id: {processId}&#xD;&#xA;Process Name: {processName}&#xD;&#xA;Win32 Thread Id: {win32ThreadId}&#xD;&#xA;Thread Name: {threadName}&#xD;&#xA;Extended Properties: {dictionary({key} - {value}&#xD;&#xA;)}"
        type="Microsoft.Practices.EnterpriseLibrary.Logging.Formatters.TextFormatter, Microsoft.Practices.EnterpriseLibrary.Logging, Version=4.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"
        name="Text Formatter" />
    </formatters>
    <categorySources>
      <add switchValue="All" name="General">
        <listeners>
          <add name="Formatted EventLog TraceListener" />
        </listeners>
      </add>
    </categorySources>
    <specialSources>
      <allEvents switchValue="All" name="All Events" />
      <notProcessed switchValue="All" name="Unprocessed Category" />
      <errors switchValue="All" name="Logging Errors &amp; Warnings">
        <listeners>
          <add name="Formatted EventLog TraceListener" />
        </listeners>
      </errors>
    </specialSources>
  </loggingConfiguration>

Answer 1

I believe that under IIS7 (which I am assuming you are using) the application pool will be running under NETWORK SERVICE.

You could try giving NETWORK SERVICE Full Control to the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application.
(Not Recommended!)

Alternatively, you could grant EVERYONE Full control to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application, log a message, then revert that change. Once the key is set up then you won't need the permissions to write to the registry.

Or you could manually configure the registry keys that you require beforehand to avoid the permission problems:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Logger]
"EventMessageFile"="c:\\WINNT\\Microsoft.NET\\Framework\\v2.0.50727\\EventLogMessages.dll"

Just an update to this answer that according to MSDN: "To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges".

Answer 2

I use a PowerShell script to create the appropriate source ...

$source = "FoToIaW"
if ([System.Diagnostics.EventLog]::SourceExists($source) -eq $false) 
{
  [System.Diagnostics.EventLog]::CreateEventSource($source, "Application")
}