3

I have created a C# application which creates custom log name in the event viewer, and writing entries into event viewer.

My application is working fine on Windows-7 OS machine But when i copied my binaries into another window-2012 server standard(SP1) machine its not working.

I ran my application RunAs administrator and I am seeing only custom log name but not the logging messages.

I have given full permission in the registry eventlog entry but no luck. Could somebody suggest me how to fix the issue. Or debugging technique to fix this issue.

I have debugged the code there are no exceptions, Code is running smoothly. my code is so simple like as below:

EventLog.CreateEventSource("MyApp", "TestingApplication")
EventLog.WriteEntry("MyApp", "Testing 123")

today i have tested with same eventsource and eventlogname, like as below EventLog.CreateEventSource("MyApp", "MyApp") it worked fine in window-2012 server standard(SP1), is there anything issue in Win-2012(SP1) or am I missing anything.

rshaik786
  • 51
  • 1
  • 7
  • Try searching SO or Internet for [EventLog.WriteEntry](http://stackoverflow.com/questions/9364258/eventlog-writeentry-does-not-write-to-designated-log-but-to-application-log) – MethodMan Nov 05 '14 at 20:00

3 Answers3

3

Even while running as an administrator, in Windows Server 2008 R2 it defaults to not having elevated privileges. You need an elevated privilege to create the source. Once the source is created, it should let you write to it.

There are a few ways to solve this, if you're building an actual application, you can modify the application manifest to require elevated privileges and admin rights:

<?xml version="1.0" encoding="utf-8" ?> 
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" 
    xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" 
    xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <assemblyIdentity version="1.0.0.0" name="MyApplication" />
    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
        <security>
            <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
                <requestedExecutionLevel level="requireAdministrator" 
        uiAccess="false" />
            </requestedPrivileges>
        </security>
    </trustInfo>
</asmv1:assembly>

Or, again if you're building a normal application, you can split the code to create the event source into a separate process. Then you can check to see if the event source exists, if it does, just use it, if it does not, you can run your new process that creates the event source.

In the Process start info you'll need the 'runas' verb.

If you're running a windows service, you're a bit more restricted, as services do not have the capability of "elevating" privileges through their manifest directly as far as I'm aware.

However, your service installer can elevate just fine, and should be running under the needed admin rights, you can create your event source inside the service installer; and then just consume it within the service itself.

Brian Deragon
  • 2,929
  • 24
  • 44
  • Hi Brian, EventLog name is created in the EventViewer, so mostly it wont be elevated privileges issue, even i tried your suggestion and it didnt work as well. but today i tried with same Source and log name like as below EventLog.CreateEventSource("MyApp", "MyApp") and it worked in Windows 2012 Standard server (SP1). Is there any problem in the Win-2012 Server (SP1). oR Am i missing anything please let me know if i am missing anything. – rshaik786 Nov 06 '14 at 18:51
3

I solved this problem by Stop/Start Windows Event Log services. I dont know what was the problem but like Leo saied it can be a bug.

Ivan Parvareshi
  • 41
  • 1
  • 2
  • 2
    yes your right, but stack over flow didn't alows me to comment on Leo's answer, so i just thoght maybe my answer would be helpful for this discussion. – Ivan Parvareshi Apr 26 '17 at 16:58
  • This worked for me. I had a similar issue--could not write to Application event log from PowerShell on Server 2012 R2 even after successfully adding source. Restarted Windows Event Log service and it starting writing events. Then restarting the Event Viewer got rid of the "description cannot be found" and "handle is invalid" junk in the event Description. – Mark Berry May 13 '21 at 19:03
1

I was having exact same issue. I am using WinServer 2012r2. Log created successfully but writing events appear in the Application Log. I read a lot of MSDN and forums and done everything up to the books and still have this problem. Seems MS has a bug in latest .Net framework which causes all messages to go to the Application Log :(

Finally after I rebooted server everything was working fine. I am not sure why would I need to reboot server if testing with eventcreate command line everything was working fine.

Leo
  • 131
  • 1
  • 9