EventLog WriteEntry does not write to designated log, but to Application log

Question

I have an application where I want to write entries to event log The logger is instantiated through MEF. I created a derived class, to be able to perform the log initializations prior of using it.

My code is as below:

public class WinEventLog : EventLog, ILogger
{
    private const string LOG_SourceName = "DataGen_Source";
    private const string LOG_SysLogName = "Pool_Log";

    private bool _isInitialized = false;

    public WinEventLog()
        : base()
    {
        Initialize();
    }

    public void LogMessage(MessageLevel level, string message)
    {
        WriteEntry(message, level.EventLogType());
    }

    public void LogMessage(string source, MessageLevel level, string message)
    {
        WriteEntry(source, message, level.EventLogType());
    }

    public void Initialize()
    {
        if (!_isInitialized)
        {
            this.BeginInit();
            this.EndInit();

            if (!System.Diagnostics.EventLog.SourceExists(LOG_SourceName))
            {
                System.Diagnostics.EventLog.CreateEventSource(
                    LOG_SourceName, LOG_SysLogName);
            }
            Source = LOG_SourceName;
            Log = LOG_SysLogName;
            _isInitialized = true;
        }
    }
}

However, the logger does not write into the log I specify, Pool_Log, but in Applications log.

Any idea why this happens?

EDIT

I referenced EXACT the same component from other project, and in this situation it wrote to the correct EventLog !!!

I'm puzzled!

Thanks

I am having exactly the same problem. The exact same component can write to the specified event source in one project, but can not in another project, writing anything to the standard application log. — Lorgarn, Mar 19 '14 at 12:03
Just ran into this - solved it by rebooting. If you originally created the source under 'Application' and then changed it later to 'CustomApp', it takes a reboot for the system to behave correctly; until your reboot, your events will continue to appear under 'Application'. — Mike, Apr 04 '14 at 15:38
@Mike Rebooting also worked for me. I went so far as uninstalling the the service I created, checking attributes on the event logger installer that Visual Studio added, Removing registry keys. Finally tried rebooting. It worked. — Bryan Hazelbaker, Jun 17 '16 at 15:52

score 2 · Answer 1 · answered Feb 20 '12 at 16:15

it appears that you are creating the source but not creating the actual Log for example I would do something like the following if I wanted to create a SQLEventLog

public bool CreateLog(string strLogName)
{
    bool Result = false;

    try
    {
            System.Diagnostics.EventLog.CreateEventSource(strLogName, strLogName);
            System.Diagnostics.EventLog SQLEventLog = 
            new System.Diagnostics.EventLog();

            SQLEventLog.Source = strLogName;
            SQLEventLog.Log = strLogName;

            SQLEventLog.Source = strLogName;
            SQLEventLog.WriteEntry("The " + strLogName + " was successfully 
        initialize component.", EventLogEntryType.Information);

            Result = true;
    }
    catch
    {
        Result = false;
    }

    return Result;
}

let me know if this helps.. looks like you are missing the EventLog Creation

Sorry, but in what line do you create the eventlog? As far as I can tell, you also just create the source, then assign source and log and finally write to log. BTW, the log was created by my code, since I see it (it's just is empty, all entries goes to Application) — bzamfir, Feb 20 '12 at 16:55

score 2 · Answer 2 · answered Feb 20 '12 at 17:07

you can try the following :

evntSource = "MySource";

evntLog = "MyLog"; //This replace Application!
evntEvent = "My Event";
if (!EventLog.SourceExists(evntSource))
    EventLog.CreateEventSource(evntSource,evntLog); 

EventLog.WriteEntry(evntSource,evntEvent);

score 0 · Answer 3 · edited Mar 17 '17 at 10:45

0

Your error may be related to permissions. Check the permissions on the registry keys of the event source.

Lastly, you shouldn't use WriteEntry, you will get a Security Exception, and other issues.

In my opinion you should use WriteEvent instead see: https://security.stackexchange.com/q/15857/396

edited Mar 17 '17 at 10:45

Community

1
1

answered Jun 08 '12 at 23:04

makerofthings7

60,103
53
215
448

score 0 · Answer 4 · answered Aug 16 '17 at 02:45

check if Event Log Source is not long and does not contain special meaningful characters such as .\ or ./

In my case this was the cause event was going to Application Log instead of designated custom log.

public static void EventLogWrite(string Source, string Message, short categoryID, int eventID, EventLogEntryType entryType)
{
#if !DEBUG
  if (!EventLog.SourceExists(Source))
    EventLog.CreateEventSource(Source.RefineText(), "My Log Name");

  EventLog.WriteEntry(Source.RefineText(), Message.TrimText(3000), entryType, eventID, categoryID);
#endif
}

EventLog WriteEntry does not write to designated log, but to Application log

4 Answers4

Linked