none
Error writing to Application Event Log

    Question

  • The following code runs fine under WinXP, but fails under Vista Beta 2 (build 5384) on the WriteEntry call with the error "The source was not found, but some or all event logs could not be searched.  Inaccessible logs: Security" 

        public static void LogException(Exception ex) {
          using (EventLog eventLog = new EventLog()) {
            eventLog.Source = PS4Strings.ProductFullName;
            eventLog.Log = "Application";
            eventLog.WriteEntry(ExceptionToText(ex), EventLogEntryType.Error);
          }
        }

    Is there a change I need to make to my code to make this work under Vista?

    Any help would be appreciated.
    Thanks

    Thursday, July 06, 2006 4:22 PM

Answers

All replies

  • You are attempting to create an event source that doesn't exist, and the account that you are using to create the source (implicitly through your attempt to write an entry) doesn't have access to all registry keys required for the source to be created.

    I've answered a similar question before - have a look here:
    http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=324053&SiteID=1
    Thursday, July 06, 2006 4:27 PM
  • Thanks for your help. 

    I saw this post earlier, but didn't think it applied because I was using an existing event log.  After re-reading your post, and more investigation, I have a deeper understanding of how event logs work and now realize that your post does apply because I'm creating a new event source for the existing log.

    Thursday, July 06, 2006 7:19 PM
  • Personally, I find it quite silly that to create an event source for one Event log, a scan is done to check whether that source exists under all logs first. Still, that's how it works.

    Glad to help.
    Thursday, July 06, 2006 7:43 PM
  • The problem I had and caused this error was the fact the service was set to log on with Local Service in stead of Local System. Changing the log on property of the project installer to Local System was the only thing I needed to change to get rid of this error. You should check this also before changing the registry permissions.
    • Proposed as answer by FarzanCool Monday, November 23, 2009 7:36 AM
    Thursday, February 07, 2008 10:31 AM
  • Ok, so where do you put the .NET code to manually create this?  in a  .cs file but which and where?

    Tuesday, March 25, 2008 2:01 AM
  • The Problem generally occurs in Vista. The Solution is as below :-

    Step 1:

    # Start -> Run -> regedit.exe
    # Navigate to My Computer > HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog
    # Right click this key, select Permissions, and grant the ASPNET account read/write permissions as described above. Note that for the "inaccessible" logs (ie. Security, Virtual Server), you'll also need to grant read access, as permissions have been set to not inherity from the parent key.
    # Restart IIS (start -> Run  -> iisreset)
    # Cause the code line that creates the event source to be executed (EventLog.CreateEventSource())

    Step 2:

    Go in Control Panel -> Administrative Tools -> Computer Management -> Local Users and Groups

    Select Administrator Group -> Right Click -> Add to Group Users "Network Service".

    It should Work

    ASPNET is replaced in Vista with "Network Service".

    :-)


    Wednesday, December 03, 2008 7:22 PM

  • Go in Control Panel -> Administrative Tools -> Computer Management -> Local Users and Groups
    Select Administrator Group -> Right Click -> Add to Group Users "Network Service".


    Great stuff, solved my problem. However, I'm on Windows Server 2008 and didn't need to do this bit quoted above. I just applied the security permissions to the SECURITY event log and bingo - sorted.

    For info - my event logging is in my Global.asax:

        public void Application_Error(object sender, EventArgs args)
        {
           
            // ********************************
            // Write to event log
            // ********************************
            try
            {           
                EventLog.WriteEntry("My Website", Server.GetLastError().ToString(), EventLogEntryType.Error);
            }
            catch{
            }
        }

    Thanks
           
    Thursday, May 07, 2009 8:48 AM
  • I am on the Windows Server 2008. I've been getting the following error trying to start the Windows service I installed:


    System.Security.SecurityException: The source was not found, but some or all event logs could not be searched.  Inaccessible logs: Security.

       at System.Diagnostics.EventLog.FindSourceRegistration(String source, String machineName, Boolean readOnly)

    The solution is:

    1.      Start\Run\regedit

    2.      Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security

    3.      Add the service account you are running your service under, in the Permissions

     

    Wednesday, March 17, 2010 4:26 PM
  • Worked for me in Windows 7.  Thanks for the fix!!
    Thursday, April 08, 2010 8:33 PM
  • This worked for me as well, on Windows 7. Thanks!!
    Wednesday, January 05, 2011 11:09 PM
  • Very good! It works in Window 7
    Wednesday, March 23, 2011 12:35 PM
  • It might work, but I'm concerned about the securities issues that giving "Network Service" Administrator rights.

    You probably don't want to do that on a dev machine, and you DEFINITELY don't want to do that on a production server, for obvious reasons.

    Thursday, April 21, 2011 2:35 PM
  • This one didn't work for me under Win7. I even added ASPNET as an admin as well as NETWORK SERVICE, and granted permissions to Application and Security logs in the registry. I'm still getting the same error.

     

    If any one has any other ideas, I'd be extremely grateful!

     

    -John

    Friday, April 22, 2011 8:45 PM
  • We've found that creating the event source is the step that requires privilege, and writing a log using that source does not. 

    Therefore we create a separate app that just has the create event source step.  (For installed apps, this is executed as part of the setup project.)  We always have a logged-in user execute this piece.  That way the rights are assigned to the specific user.  Typically our users are admins on the box, so they have the rights.

    Then the actual app can write as many log entries as it needs and never has to acquire additional privilege.

     

    Friday, June 03, 2011 9:12 PM
  • Agree with Doug; "creating the event source is the step that requires privilege, and not writing the actual log." Once source is created, there should be no security problems when creating a new windows event log.

    I use Windows Eventcreate.exe command to accomplish this. (Plenty of online information available on this command.)

    eventcreate /ID 1 /L APPLICATION /T INFORMATION /SO "My Custom Event Source" /D "Custom event source created!"

    I run this command in my application's installer script. Only needs to be run once. Eventcreate.exe not only creates a Windows event log, but also creates the event source if it does not exist.

    Thursday, June 23, 2011 2:10 AM
  • This fix worked for my situation, which was also a .Net application (.Net 2) running on Windows 2008 R2.  Thanks gyazgan.
    Friday, July 29, 2011 12:37 AM