none
Windows event log not being created, no exception RRS feed

  • Question

  • Running on a desktop I have the following code:

            if (!EventLog.SourceExists("AutoTag"))
                EventLog.CreateEventSource("AutoTag", "AutoTag");
    
            // Create an EventLog instance and assign its source.
            EventLog myLog = new EventLog();
            myLog.Source = "AutoTag";
    
            // Write an entry to the event log.    
            myLog.WriteEntry(msg, EventLogEntryType.Warning);

    This works fine on all systems here but one. For that one no exception is thrown but the event log is not created.

    Why?


    What we did for the last 6 months - Made the world's coolest reporting & docgen system even more amazing

    Monday, May 16, 2016 3:54 PM

Answers

  • You could run Process Monitor on good and bad computers and compare the logs. Set a filter so it includes only those events in which Path contains "eventlog" and Process Name matches your program.

    Anyway, the probable cause is that an "AutoTag" event source has been created in some other log, most likely in the "Application" log. This has two effects:

    • EventLog.SourceExists("AutoTag") returns true. Your code then does not call EventLog.CreateEventSource, and the "AutoTag" log is not created.
    • When you write events from the "AutoTag" event source, the Windows Event Log service saves them in the same "Application" log as before, even if you have already called EventLog.DeleteEventSource("AutoTag") and EventLog.CreateEventSource("AutoTag", "AutoTag"), and the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\AutoTag" Registry key no longer exists. AFAIK, the Windows Event Log service will remember the previous log of the event source until you restart Windows.
    Wednesday, May 18, 2016 4:01 PM

All replies

  • Hi David,

    I also tested your code on my side, it works fine and create the event log successfully.

    Here is my test result.


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.

    Tuesday, May 17, 2016 5:58 AM
  • It runs fine on my computer too. The problem is on one system, and one system only, while the code runs fine, nothing is created in the event log.

    As no exception is thrown, how do I figure out why this is failing?

    thanks - dave


    What we did for the last 6 months - Made the world's coolest reporting & docgen system even more amazing

    Tuesday, May 17, 2016 11:10 AM
  • It runs fine on my computer too. The problem is on one system, and one system only, while the code runs fine, nothing is created in the event log.

    As no exception is thrown, how do I figure out why this is failing?

    thanks - dave


    What we did for the last 6 months - Made the world's coolest reporting & docgen system even more amazing

    @Dave,

    As you said, this issue only happens on one system, so to me, it is too hard for me to locate where the issue is. I would suggest you try to do a comparison of the environment on the issue machine and the fine machine. Try to find if there is something wrong with it, for example, some third-party products like antivirus software or firewall blocks you. It also maybe something wrong with your registry and so on. These are just a guess, hope it helps.

    If you have any discovery, please remember to share here, It could be for someone who has the same issue, thanks.

    Best regards,

    Kristin


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click HERE to participate the survey.


    • Edited by Kristin Xie Wednesday, May 18, 2016 9:30 AM
    Wednesday, May 18, 2016 9:28 AM
  • You could run Process Monitor on good and bad computers and compare the logs. Set a filter so it includes only those events in which Path contains "eventlog" and Process Name matches your program.

    Anyway, the probable cause is that an "AutoTag" event source has been created in some other log, most likely in the "Application" log. This has two effects:

    • EventLog.SourceExists("AutoTag") returns true. Your code then does not call EventLog.CreateEventSource, and the "AutoTag" log is not created.
    • When you write events from the "AutoTag" event source, the Windows Event Log service saves them in the same "Application" log as before, even if you have already called EventLog.DeleteEventSource("AutoTag") and EventLog.CreateEventSource("AutoTag", "AutoTag"), and the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\AutoTag" Registry key no longer exists. AFAIK, the Windows Event Log service will remember the previous log of the event source until you restart Windows.
    Wednesday, May 18, 2016 4:01 PM