[VB.NET] Adding EventLog entries

[stavris]

Hi all,

I have come across this the other day and I thought I should share.

The problem:
From Windows Vista onwards, with all the UAC security stuff I have noticed that you can't just go ahead and add an entry in the EventLog if your event source does not already exist...
So the line of code below:

EventLog.WriteEntry("My Application", message, EventLogEntryType.Error)

might throw an error saying something along the line:

System.Security.SecurityException: The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.

The solution:
What you can do in order to avoid this is to explicitly add the event source to your event log:

Dim eventSource As String = "My Application" 
If Not EventLog.SourceExists(eventSource) Then
     EventLog.CreateEventSource(eventSource, "Application")
             
End If

To do this though you need to have admin rights and also if you are going to do this with an application you have to run the application as an administrator (right click, Run as Administrator)

Once the event source is there then you can resume adding messages to the event log as normal

[chris128]

But if you just run the program "As Administrator" in the first place then won't your first example just add the event log source anyway? I'm not suggesting that it would be a good idea to require your app to always run as administrator, I'm just saying that I don't think there is any need for that second lot of code because you have got to run that as administrator anyway so why not just run the original line of code as administrator once so that it adds the source itself.

[stavris]

Hi Chris,

I guess you are right.
I tend to add the event source with my installer (which will run as admin anyway) and for aesthetic reasons I prefer not to add random messages in the event log.

That said you have a very valid point that both methods will work.

[chris128]

Yeah I guess it is better to do it that way if its going to be in an installer, as like you said there is not much point just writing an unnecessary event to the event log