Can I use either EventLog or EventSource for both logging and tracing?

Question

I'm trying to create a simplified API for both logging (errors, warnings, info) and tracing (debug, analytics) to the Windows Event Log so I can use Windows Event Viewer to work with the logs. I found the EventLog class and started coding against it, and it works for logging to the Application log. I can't find any documentation on specifying the log subcategory with this class, though. I need to push trace info to the Analytic and Debug logs, and I'd like to let the application choose whether logged events go to the Admin or Operational logs.

I then learned about the EventSource class, and various blogs on MSDN indicate that it does allow you to specify the logging "channel", but I don't know whether the channel is another word for the log subcategory.

This is the only thread I could find comparing the two classes, and it didn't seem to answer what I need to know:

1. Can I use either EventLog or EventSource for logging to a specific to WEL subcategory?
2. Is one of them recommended over the other in the .NET 4.5 framework? ie is EventLog considered to be deprecated, or is it meant only for non-trace use?

Answer 1

Yes you can use EventLog as shown here or EventSource as shown here and here . I know of no official recommendation, but in my opinion it is easier to write a strong typed log message with EventSource. It also has more features and with this you can even use it with .Net 3.5 if you want.

Answer 2

Looks like I misinterpreted the Help/TechNet info on these logs. There are the Windows Logs -- Application Security, Setup, System, ForwardedEvents -- and then there are custom Applications and Services Logs. Only the latter may have a subtype: Admin, Operational, Analytic, Debug. The Windows Logs don't have subtypes, and they're intended only for logging (not tracing), so they don't accept a logging level that equates to "Debug" or "Trace".

That being said, the EventLog class suits my needs for logging, but it doesn't seem to provide enough features to interface with ETW for tracing. If I want to write to trace-worthy logs, I'll have to use ETW and the EventSource class is better equipped for that.

Answer 3

You don't need an API - it's built in to .Net. Consider TraceSource and the EventLogTraceListener . You can apply filters to message types to send only those messages which are 'event log worthy' to the event log, and use ETW and custom trace listeners to capture transient debug data. Reconfiguration can be done at runtime to help with debugging. Also an upside - there are a ton of TraceSources built in to the .net framework.

See this SO answer , and this blog post for more on why TraceSource is a good option