The Source and Log properties must be matched

Question

When I try to start the service I get the following error:

Service cannot be started. System.ArgumentException: The source 'Bar source' is not registered in log 'Bar2'. (It is registered in log 'Bar source'.) " The Source and Log properties must be matched, or you may set Log to the empty string, and it will automatically be matched to the Source property. at System.Diagnostics.EventLogInternal.VerifyAndCreateSource(String sourceName, String currentMachineName) at System.Diagnostics.EventLogInternal.WriteEntry(String message, EventLogEntryType type, Int32 eventID, Int16 category, Byte[] rawData) at System.Diagnostics.EventLog.WriteEntry(String message) at Bar.Service1.writeToLog(String msg) in C:\Program Files (x86)\Bar - Used on APPS\Service1.vb:line 292 at Bar.Service1.OnStart(String[] args) in C:\Program Files (x86)\Bar - Used on APPS\Service1.vb:line 37 at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Does anyone know what can cause the issue? I don't have any mention to Bar2 in the code, the folder in program files was called "Bar2" but I changed it to "Bar".

Please advise!

this is the WriteToLog function:

Private Sub writeToLog(ByVal msg As String)
    Dim evtLog As New EventLog
    If Not Diagnostics.EventLog.SourceExists("Bar") Then
        Diagnostics.EventLog.CreateEventSource("Bar", "Log of Bar")
    End If
    evtLog.Source = "Bar"
    evtLog.Log = "Log of Bar"
    evtLog.WriteEntry(msg)
End Sub

Answer 1

The Log property stores the name of the event log, as visible in the Control Panel > Administrative Tools > Event Viewer applet. Most applications log to the Windows Logs > Application log, the default when you don't assign the Log property. But you can create a custom log for your own app, visible under the "Applications and Services Log" entry.

This info is recorded in the registry at the time you first create the log with CreateEventSource. The Log property must be a match in the future, if it is not then you get this exception. So what you know is that the log in fact already existed, but you once created it with a different log name, "Bar2". Possibly deciding that wasn't a very good name and changing the Log property. Kaboom.

Setting the Log property to an empty string is not a workaround. It will continue to log to the original log name, using the registry to find its name back. You can fix the unwanted registration with Regedit.exe, navigate to HKLM\SYSTEM\CurrentControlSet\Services\EventLog. If you delete the entry then you should also delete the corresponding .evtx file, the File value gives you its path name.

Answer 2

In my case I was assigning a log named "P5-RUN Analytics LOG" to the service named "FSSH P5-RUN Analytics".

Not working: Public Sub New()

    ' This call is required by the designer.
    InitializeComponent()

    Try
        If Not System.Diagnostics.EventLog.SourceExists("FSSH P5-RUN Analytics") Then
            System.Diagnostics.EventLog.CreateEventSource("FSSH P5-RUN Analytics", "P5-RUN Analytics Log")
        End If

        EventLog1.Source = "FSSH P5-RUN Analytics"
        EventLog1.Log = "P5-RUN Analytics Log"
    Catch ex As Exception

    End Try

End Sub 

Working:

Public Sub New()

    ' This call is required by the designer.
    InitializeComponent()

    Try
        If Not System.Diagnostics.EventLog.SourceExists("P5-RUN Analytics") Then
            System.Diagnostics.EventLog.CreateEventSource("P5-RUN Analytics", "P5-RUN Analytics Log")
        End If

        EventLog1.Source = "P5-RUN Analytics"
        EventLog1.Log = "P5-RUN Analytics Log"
    Catch ex As Exception

    End Try

End Sub

Once I made the first six characters of the service and log match it installed correctly and worked like a charm. It rings a bell from some other article about services conflicting if the first few characters are not in sync (or are duplicated?), but I don't remember where that article was posted.

Last, once I made the changes to my service and log names I cleared the old service/log names from the registry at HKLM\SYSTEM\CurrentControlSet\Service\EventLog before I re-installed my service.

Answer 3

Leaving the log as an empty string solved the error:

Private Sub writeToLog(ByVal msg As String)
    Dim evtLog As New EventLog
    If Not Diagnostics.EventLog.SourceExists("Bar") Then
        Diagnostics.EventLog.CreateEventSource("Bar", "")
    End If
    evtLog.Source = "Bar"
    evtLog.Log = ""
    evtLog.WriteEntry(msg)
End Sub