locked
EventLog Access error RRS feed

  • Question

  • Hi,

    When my Windows Service tries to write to event log I get below error. Service Log on set to Local System. Also tried Network Service.

    Any ideas? Thanks!

    Server was unable to process request. ---> The source was not found, but some or all event logs could not be searched.  Inaccessible logs: Security.

    Monday, November 12, 2012 6:08 PM

Answers

  • >The source was not found

    You forgot to add the registry script that creates the event source to your program's installer? 



    Visual C++ MVP

    • Proposed as answer by Bob Wu-MT Thursday, November 15, 2012 6:35 AM
    • Marked as answer by Bob Wu-MT Tuesday, November 27, 2012 11:42 AM
    Monday, November 12, 2012 10:30 PM
  • EventLog.SourceExists enumerates through the subkeys of HKLM\SYSTEM\CurrentControlSet\services\eventlog to see if it contains a subkey with the specified name. If the user account under which the code is running does not have read access to a subkey that it attempts to access (in your case, the Security subkey) before finding the target source, you will see an exception like the one you have described.

    The usual approach for handling such issues is to register event log sources at installation time (under an administrator account), then assume that they exist at runtime, allowing any resulting exception to be treated as unexpected if a target event log source does not actually exist at runt
    • Proposed as answer by Bob Wu-MT Thursday, November 15, 2012 6:34 AM
    • Marked as answer by Bob Wu-MT Tuesday, November 27, 2012 11:42 AM
    Tuesday, November 13, 2012 6:54 AM

All replies

  • >The source was not found

    You forgot to add the registry script that creates the event source to your program's installer? 



    Visual C++ MVP

    • Proposed as answer by Bob Wu-MT Thursday, November 15, 2012 6:35 AM
    • Marked as answer by Bob Wu-MT Tuesday, November 27, 2012 11:42 AM
    Monday, November 12, 2012 10:30 PM
  • EventLog.SourceExists enumerates through the subkeys of HKLM\SYSTEM\CurrentControlSet\services\eventlog to see if it contains a subkey with the specified name. If the user account under which the code is running does not have read access to a subkey that it attempts to access (in your case, the Security subkey) before finding the target source, you will see an exception like the one you have described.

    The usual approach for handling such issues is to register event log sources at installation time (under an administrator account), then assume that they exist at runtime, allowing any resulting exception to be treated as unexpected if a target event log source does not actually exist at runt
    • Proposed as answer by Bob Wu-MT Thursday, November 15, 2012 6:34 AM
    • Marked as answer by Bob Wu-MT Tuesday, November 27, 2012 11:42 AM
    Tuesday, November 13, 2012 6:54 AM