将事件写入事件日志期间的WCF异常

Question

Exception during writing event log on host machine(Windows 2008 R2) hosting WCF Service named my machine from WCFClient (Windows 7) running within domain but on a different machine.

WCF Client is impersonated to access resources on Server.

So far following links have not helped

http://support.microsoft.com/kb/2028427#appliesto

http://forums.asp.net/t/1131903.aspx

http://msdn.microsoft.com/en-us/library/Aa379567 (Detals about SDDL) http://blogs.dirteam.com/blogs/jorge/archive/2008/03/26/parsing-sddl-strings.aspx (SDDL)

similar question on SO without any answer https://stackoverflow.com/questions/6456444/allow-wcf-services-writing-to-custom-event-log-under-windows-2008-r2-server

Exception is as follows

System.ServiceModel.FaultException`1[System.ServiceModel.ExceptionDetail]: Cannot open log for source 'MyService'. You may not have write access. (Fault Detail is equal to An ExceptionDetail, likely created by IncludeExceptionDetailInFaults=true, whose value is: System.InvalidOperationException: Cannot open log for source 'MyService'. You may not have write access. ----> System.ComponentModel.Win32Exception: Access is denied

--- End of inner ExceptionDetail stack trace --- at System.Diagnostics.EventLogInternal.OpenForWrite(String currentMachineName) at System.Diagnostics.EventLogInternal.InternalWriteEvent(UInt32 eventID, UInt16 category, EventLogEntryType type, String[] strings, Byte[] rawData, String currentMachineName) at System.Diagnostics.EventLogInternal.WriteEntry(String message, EventLogEntryType type, Int32 eventID, Int16 category, Byte[] rawData) at System.Diagnostics.EventLog.WriteEntry(String message, EventLogEntryType type) ................... .....................

Answer 1

Is this a custom event log? If so, refer to

http://msdn.microsoft.com/en-us/library/49dwckkz(v=vs.80).aspx

-- and in particular

In general, create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources and you attempt to write an event with the new source, the write operation will fail. If creating the source during installation is not an option, then try to create the source well ahead of the first write operation, perhaps during your application initialization. If you choose this approach, be sure your initialization code is running with administrator rights on the computer. These rights are required for creating new event sources.

Answer 2

Modified ProcesModel's Identity of AppPool from NetworkService to LocalSystem and everything is working.

Although this is not public facing site and is a corporate distributed setup which will run within its own domain but one can still argue about security risk.

and possible solution can be

To separate the Event writing code from Imperosnation

or just elevate permission for offending code.