I am creating a new event source and logging a message using the code below:
static void Main(string[] args)
{
if (!EventLog.SourceExists("My Log"))
{
EventLog.CreateEventSource("My Application", "My Log");
Console.WriteLine("Created new log \"My Log\"");
}
EventLog myLog = new EventLog("My Log");
myLog.Source = "My Application";
myLog.WriteEntry("Could not connect", EventLogEntryType.Error, 1001, 1);
}
A custom event log with the name "My Log" is created (as expected) but the message is logged below the "Application" node. What am I doing wrong?
To create an event source, you need to have a name for your new source (called the Event Source Name) and the name of the log where the event source will be a part. If the event log entries would be written to the standard “Application”, “System” or “Security” logs, then you can use that as the name of the log.
Each log in the Eventlog key contains subkeys called event sources. The event source is the name of the software that logs the event. It is often the name of the application or the name of a subcomponent of the application if the application is large.
In Windows, you can adjust Event Viewer settings by right-clicking the log and clicking Properties. You can adjust the following Event Log settings: Maximum log size. Overwrite events as needed.
There's the following note in MSDN:
If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.
Is it possible while trying out the code that you previously tried writing to the Application log and you now need to reboot for it to "unmap" that link?
You appear to have things mixed up somewhere there I think.
You have a source (which is your application) and that source is linked to a Log, this is done when you Create your source You have mixed these up a little bit at the beginning of your code, it should in fact be
if (!EventLog.SourceExists("My Application"))
I have just written a little code to help me out of this. source registered in another log issue which I have encountered and don't want to manually have to remove sources from logs. What I decided to do was check if the source exists, if it does check that its linked to the correct log, if it isn't delete the source, now that it doesn't exist or f it never did create the Log brand new.
protected const string EventLogName = "MyLog";
private static bool CheckSourceExists(string source) {
if (EventLog.SourceExists(source)) {
EventLog evLog = new EventLog {Source = source};
if (evLog.Log != EventLogName) {
EventLog.DeleteEventSource(source);
}
}
if (!EventLog.SourceExists(source)) {
EventLog.CreateEventSource(source, EventLogName);
EventLog.WriteEntry(source, String.Format("Event Log Created '{0}'/'{1}'", EventLogName, source), EventLogEntryType.Information);
}
return EventLog.SourceExists(source);
}
public static void WriteEventToMyLog(string source, string text, EventLogEntryType type) {
if (CheckSourceExists(source)) {
EventLog.WriteEntry(source, text, type);
}
}
Hopefully it helps :)
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With