EventLog WriteEntry not does not write into EventViewer in C#

Question

I have created a C# application which creates custom log name in the event viewer, and writing entries into event viewer.

My application is working fine on Windows-7 OS machine But when i copied my binaries into another window-2012 server standard(SP1) machine its not working.

I ran my application RunAs administrator and I am seeing only custom log name but not the logging messages.

I have given full permission in the registry eventlog entry but no luck. Could somebody suggest me how to fix the issue. Or debugging technique to fix this issue.

I have debugged the code there are no exceptions, Code is running smoothly. my code is so simple like as below:

EventLog.CreateEventSource("MyApp", "TestingApplication")
EventLog.WriteEntry("MyApp", "Testing 123")

today i have tested with same eventsource and eventlogname, like as below EventLog.CreateEventSource("MyApp", "MyApp") it worked fine in window-2012 server standard(SP1), is there anything issue in Win-2012(SP1) or am I missing anything.

Answer 1

Even while running as an administrator, in Windows Server 2008 R2 it defaults to not having elevated privileges. You need an elevated privilege to create the source. Once the source is created, it should let you write to it.

There are a few ways to solve this, if you're building an actual application, you can modify the application manifest to require elevated privileges and admin rights:

<?xml version="1.0" encoding="utf-8" ?> 
<asmv1:assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" 
    xmlns:asmv1="urn:schemas-microsoft-com:asm.v1" 
    xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <assemblyIdentity version="1.0.0.0" name="MyApplication" />
    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
        <security>
            <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
                <requestedExecutionLevel level="requireAdministrator" 
        uiAccess="false" />
            </requestedPrivileges>
        </security>
    </trustInfo>
</asmv1:assembly>  

Or, again if you're building a normal application, you can split the code to create the event source into a separate process. Then you can check to see if the event source exists, if it does, just use it, if it does not, you can run your new process that creates the event source.

In the Process start info you'll need the 'runas' verb.

If you're running a windows service, you're a bit more restricted, as services do not have the capability of "elevating" privileges through their manifest directly as far as I'm aware.

However, your service installer can elevate just fine, and should be running under the needed admin rights, you can create your event source inside the service installer; and then just consume it within the service itself.

Answer 2

I was having exact same issue. I am using WinServer 2012r2. Log created successfully but writing events appear in the Application Log. I read a lot of MSDN and forums and done everything up to the books and still have this problem. Seems MS has a bug in latest .Net framework which causes all messages to go to the Application Log :(

Finally after I rebooted server everything was working fine. I am not sure why would I need to reboot server if testing with eventcreate command line everything was working fine.

Answer 3

I solved this problem by Stop/Start Windows Event Log services. I dont know what was the problem but like Leo saied it can be a bug.