0

I have a 3rd-party app that logs (verbosely) to the users' Appdata folder. I'd like to augment that behavior to also record Errors to the EventLog. How can I accomplish this? Note that the app's source code is not available; I can only modify the .config file.

Here's the original .config file. It logs verbosely to a .log file:

<system.diagnostics>
    <switches>
        <add name="Default" value="Verbose"/>
    </switches>
    <trace autoflush="true" indentsize="4">
        <listeners>
            <add name="CPLog"
                type="ClientApp.Common.Logging.MultiProcessFileTraceListener, ClientApp.Common, Version=9.1.0.0, Culture=neutral, PublicKeyToken=c583c5a4dddb9a96"
                initializeData="@(LocalApplicationData)\ClientApp\cpwin.log" />
            <remove name="Default" />
        </listeners>
    </trace>
</system.diagnostics>

Here's what I tried (added another switch and another listener. EventLog gets written if I set its switch to Verbose, but nothing gets ever written when set to Error (even when errors occur):

<system.diagnostics>
    <switches>
        <add name="Default" value="Verbose"/>
        <add name="EventLog" value="Error"/>
    </switches>
    <trace autoflush="true" indentsize="4">
        <listeners>
            <add name="CPLog"
                type="ClientApp.Common.Logging.MultiProcessFileTraceListener, ClientApp.Common, Version=9.1.0.0, Culture=neutral, PublicKeyToken=c583c5a4dddb9a96"
                initializeData="@(LocalApplicationData)\ClientApp\cpwin.log" />
            <add name="EventLog" type="System.Diagnostics.EventLogTraceListener" initializeData="Client Info" />
            <remove name="Default" />
        </listeners>
    </trace>
</system.diagnostics>

How could I accomplish this?

Mark Maslar
  • 1,121
  • 4
  • 16
  • 28
  • What sort of app is this? If it is a web app, often the system account doesn't have the permissions to create a new event log, and sometimes doesn't have permissions to write to an existing event log (say Application). I'd check to see if you can get a textwriter working & logging to the same folder/different file, and then try the event log. ref http://msdn.microsoft.com/en-us/library/sk36c28t.aspx – MatthewMartin Jun 13 '13 at 20:09
  • This is a fat-client app. .exe.config. It isn't a permissions issue; it does write entries to the event log when the EventLog switch is set to Verbose -- just not when it is set to Error. – Mark Maslar Jun 14 '13 at 12:50

1 Answers1

0

You mean like when Exceptions happen or when the original app developer wrote to the Trace or TraceSource with a level of Error? They are different things and if the orig dev didn't catch all errors and write to trace with a level of Error, they you wouldn't expect to see errors this way. Also, if it is an unhandled exception, it certainly won't be traced. If you have the source code you might want to implement a global error handler like this: http://www.codeproject.com/Articles/14912/A-Simple-Class-to-Catch-Unhandled-Exceptions-in-Wi

Application.ThreadException and Application.SetUnhandledExceptionMode seem to be the relevant events.

If you don't have that, you might want to write a custom trace filter, which will allow you to send everything (Verbose) to the event log, but filter out all the messages without a substring of "Error" or what ever it is that distinguishes an error-type message from a non-error type message. (And again, this assumes that there is a catch block and in that block there is a Trace or TraceSource write statement with error info)

MatthewMartin
  • 32,326
  • 33
  • 105
  • 164
  • Yes, the original app developer wrote to the Trace or TraceSource with a level of Error. I want to send just those Error-level messages to the Event Log. Source code is not available. – Mark Maslar Jun 17 '13 at 14:05
  • 1
    I'm skeptical you can verify what level param the original dev used unless you decompiled the code. Since it works with a value of Verbose, the listener must be registered correctly, that just leaves the switch to fiddle with. You could try the numeric value 2-- some times the enumeration text value is different from what it actually is, but that is more common with the lesser used values, like Resume,Suspend, Transfer, etc. After that I'm out of ideas and would need to see the decompiled trace command. There are several free decompilers that do a decent job. – MatthewMartin Jun 17 '13 at 16:23