Using System.Diagnostics.EventLog .NET type one can programmatically create logs into the Event Viewer application.
Does anybody knows about "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\XXX\" registry entry?
Who uses this assembly and how it is used?
What is the preferred method? Using EventLog type or the registry entry? Or is this question even valid?
-Datte
Basicaly Event Logging service uses "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\" key to store configuration variables for each event source (i.e. location of the log files). In fact the actual logs are stored in these files.
So I believe it is possible to update the registry and manage the log file yourself but it is not a good idea at all. I'd prefer using the API.
You can check here for details: http://msdn.microsoft.com/en-us/library/windows/desktop/aa363648(v=vs.85).aspx
I prefer using the EventLogInstaller and create the event log sources using installutil explicitly.
About who uses the assembly, I guess whoever wants to write to the EventLog. Keep in mind that there are other ways to write to the EventLog from .NET applications that use instrumentation manifests. Take a look at the System.Diagnostics.Eventing namespace.
