EventLog WriteEntry does not write to the designated log, but to the application log

Question

I have an application in which I want to write entries to the event log. The logger is launched via MEF. I created a derived class to be able to initialize the log before using it.

My code is as follows:

public class WinEventLog : EventLog, ILogger { private const string LOG_SourceName = "DataGen_Source"; private const string LOG_SysLogName = "Pool_Log"; private bool _isInitialized = false; public WinEventLog() : base() { Initialize(); } public void LogMessage(MessageLevel level, string message) { WriteEntry(message, level.EventLogType()); } public void LogMessage(string source, MessageLevel level, string message) { WriteEntry(source, message, level.EventLogType()); } public void Initialize() { if (!_isInitialized) { this.BeginInit(); this.EndInit(); if (!System.Diagnostics.EventLog.SourceExists(LOG_SourceName)) { System.Diagnostics.EventLog.CreateEventSource( LOG_SourceName, LOG_SysLogName); } Source = LOG_SourceName; Log = LOG_SysLogName; _isInitialized = true; } } } 

However, the registrar does not write to the log that I specify, Pool_Log, but in the application log.

Any idea why this is happening?

---

EDIT

I mentioned EXACT the same component from another project, and in this situation he wrote the correct EventLog !!!

I am puzzled!

thanks

Answer 1

you can try the following:

 evntSource = "MySource"; evntLog = "MyLog"; //This replace Application! evntEvent = "My Event"; if (!EventLog.SourceExists(evntSource)) EventLog.CreateEventSource(evntSource,evntLog); EventLog.WriteEntry(evntSource,evntEvent); 

Answer 2

it looks like you are creating a source but not creating the actual log, for example, I would do something like the following if I wanted to create a SQLEventLog

 public bool CreateLog(string strLogName) { bool Result = false; try { System.Diagnostics.EventLog.CreateEventSource(strLogName, strLogName); System.Diagnostics.EventLog SQLEventLog = new System.Diagnostics.EventLog(); SQLEventLog.Source = strLogName; SQLEventLog.Log = strLogName; SQLEventLog.Source = strLogName; SQLEventLog.WriteEntry("The " + strLogName + " was successfully initialize component.", EventLogEntryType.Information); Result = true; } catch { Result = false; } return Result; } 

let me know if this helps .. it looks like you were unable to create an EventLog Creation

Answer 3

Your error may be related to permissions. Check permissions for event source registry keys.

Finally, you should not use WriteEntry, you will get a security exception and other problems.

In my opinion, you should use WriteEvent instead: https://security.stackexchange.com/q/15857/396

Answer 4

check if the event log source is not long and does not contain special significant characters, such as. \ or. /

In my case, this event raised an event in the application log instead of the assigned user log.

 public static void EventLogWrite(string Source, string Message, short categoryID, int eventID, EventLogEntryType entryType) { #if !DEBUG if (!EventLog.SourceExists(Source)) EventLog.CreateEventSource(Source.RefineText(), "My Log Name"); EventLog.WriteEntry(Source.RefineText(), Message.TrimText(3000), entryType, eventID, categoryID); #endif }