none
Eventlog: Unregister Source from Application RRS feed

  • Question

  • Hi all,

    has anyone an idea how to remove a eventlog source completely out of the application log? I tried

    System.Diagnostics.EventLog.DeleteEventSource(logSource);


    But somehow the source is still registered in the application log, when I try to create it and write something in it

    private readonly string logSource = "ICustomService";
    private readonly string logName = "I Custom Service";
    
    eventLog1 = new System.Diagnostics.EventLog();
    
                System.Diagnostics.EventLog.DeleteEventSource(logSource);
    
                if (!System.Diagnostics.EventLog.SourceExists(logSource))
                {
                    System.Diagnostics.EventLog.CreateEventSource(logSource, logName);
                }
    
    eventLog1.Source = logSource;
                eventLog1.Log = logName;
                eventLog1.WriteEntry("Started", EventLogEntryType.Information);
    
                Timer timer = new Timer();
                timer.Interval = 6000; // 1min
                timer.Elapsed += new ElapsedEventHandler(this.OnTimer);
                timer.Start();

    After I install and start the service, a new eventlog tree "I Custom Service" appears. But the 'WriteEntry' it does still write to the application log.

    I also removed the registry key from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application -> I Custom Service, and restarted my machine several times now.

    What I am doing wrong?

    (This post is related to my previous question: https://social.msdn.microsoft.com/Forums/en-US/b89ed6d5-0b8a-4923-91fa-731403fafc63/microsoft-service-tutorial-eventlog-writeentry-crashes-service?forum=csharpgeneral )

    EDIT:

    I can still see it in the application "log name" when I take a look with the powershell command

    Get-EventLog -LogName * |ForEach-Object {$LogName = $_.Log;Get-EventLog -LogName $LogName -ErrorAction SilentlyContinue |Select-Object @{Name= "Log Name";Expression = {$LogName}}, Source -Unique}


    EDIT 2:

    I tried to delete it in a unit test again: The event log source I Custom Service cannot be deleted, since it is identical to the log name'.

    • Edited by dr34mup Friday, August 2, 2019 8:11 AM
    Friday, August 2, 2019 7:58 AM

All replies

  • IMHO, just stop what you're doing, becuase the messages will eventually rollout of Application events.

     You should also be using a logging library like Log4Net, which is free to use.

    Friday, August 2, 2019 8:53 AM
  • Thanks for your answer, I'll keep that in mind. The only thing is that I actually followed the MS Tutorial so that I don't have to deal with unnecessary topics that I think should work.
    Friday, August 2, 2019 10:25 AM
  • Thanks for your answer, I'll keep that in mind. The only thing is that I actually followed the MS Tutorial so that I don't have to deal with unnecessary topics that I think should work.
    If you follow MS tutorials and think they are the  gospel, then that's another problem in itself. :) You'll learn one way or the other. 


    • Edited by DA924x Friday, August 2, 2019 6:32 PM
    Friday, August 2, 2019 10:35 AM
  • Ok? This means MS tutorials are not best practice? Can you recommend me a better site,.. for creating a service? I would like to start with the project the right way...
    • Edited by dr34mup Monday, August 5, 2019 6:37 AM
    Monday, August 5, 2019 6:35 AM
  • Thanks for your suggestion. I started to use Serilog instead of the MS eventlog.
    Monday, August 5, 2019 3:34 PM
  • Thanks for your suggestion. I started to use Serilog instead of the MS eventlog.
    I have use Log4net, Serilog and Event log too, but left Eventl log behind long ago
    Tuesday, August 6, 2019 9:26 AM