I'm writing to the windows event log using C#. I can set every field visible in the mmc.exe "Computer Management" tool, except for the User field.
The client application is ASP.NET and uses forms authentication.
public static void WriteOnce()
{
EventLog log = new EventLog("MyApp");
if (!EventLog.SourceExists("MySource"))
{
EventSourceCreationData data = new EventSourceCreationData("MySource", "MyApp");
EventLog.CreateEventSource(data);
}
log.Source = "MySource";
log.WriteEntry("Hello World", EventLogEntryType.Information,123,456,new byte[]{1,2,3});
}
UPDATE: I checked, in ASP.NET even if set identity impersonation=true & authentication=windows and still no user.
I also checked, in a console app, no user.
Well the user is the current user your AppDomain is running as. This cannot be set and Windows won't allow you to "spoof" another user.
The user name in the Event Log is based on the context in which your application is running. It cannot be explicitly set. If this is an ASP.NET application, it may be using the service account.
EDIT: I found a similar question. It proposes using the Win32 Api ReportEvent function in order to set the user information.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With