Creating new event log source

Question

My application calls a library (which I do not have control) that creates a new EventLog source and uses EventLog.SourceExists. It throws System.Security.SecurityException: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.

The app needs read access to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Security. How do I give Network Service permissions to registry (programmatically)?

Thanks for any pointers.

score 0 · Accepted Answer · answered Jul 16 '12 at 19:56

0

You are getting this error message because your "new Source" is not registered, and for that you need administration privileges. Try run your APP as "Administrator" in Console.

I once hacked the "registry" as well, by adding in the "Source" myself, but that's probably ill-advised.

answered Jul 16 '12 at 19:56

Dane Balia

5,271
5
32
57

My application doesn't need admin privileges, just that, read access is required for the Security branch. – Sam Jul 16 '12 at 20:05
The security branch by "design" is allowed only to those who have Administrator or Domain Privileges(read only). Programmatically to bypass this, you might need to alter "registry settings". KB attached: http://support.microsoft.com/kb/323076 – Dane Balia Jul 16 '12 at 20:16

score 0 · Answer 2 · answered Mar 19 '13 at 15:28

I hit this same problem today and none of the answers for WinForms or ASPX seemed practicable for my situation (a non-installing scheduled task exe). So I did this: -

    protected void prog_Load(object sender, EventArgs e)
    {
        boolean setupComplete = false;
        try // setting an Event log entry, just to see if we can
        {
            logEvent = "prog started";
            EventLog.WriteEntry(logSource, logEvent, EventLogEntryType.Information, 0);
            setupComplete = true;
        }
        catch (Exception eLog1) // we can't, so try to fix
        {
            try
            {
                EventLog.CreateEventSource(logSource, logLog);
                logEvent = "prog registered for Event Logging";
                EventLog.WriteEntry(logSource, logEvent, EventLogEntryType.Information, 0);
            }
            catch (Exception eLog2) // aha!  we probably lack admin rights to set the registry key
            {
                MessageBox.Show("prog needs admin rights the first time it runs", "prog Setup", MessageBoxButtons.OK, MessageBoxIcon.Warning);
            }
        }

        // run
        if (setupComplete == true)
        {
            DoTheWork();
        }

        // exit
        this.Close();
    }

Creating new event log source

2 Answers2