EventLog.CreateEventSource is not creating a custom log

Question

I have some code like this:

EventLog.CreateEventSource("myApp", "myAppLog");
EventLog.WriteEntry("myApp", "Test log message", EventLogEntryType.Error);

Now, unless I'm missing something having read MSDN, this should cause a new log 'myAppLog' to be created in the event viewer, and an entry should be added to that new log with the source name 'myApp'. But, I can't get the new log to be created. This always just writes an error log message to the Application log, with the source 'myApp' - 'myAppLog' is nowhere to be seen. What am I doing wrong? I am logged in as an Administrator.

Answer 1

Is it possible that you already used the source "myApp" when writing to the standard Application log? If so according to MSDN:

If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

http://msdn.microsoft.com/en-us/library/2awhba7a.aspx (about half way down the page)

Answer 2

I have just written a little code to help me out of this. source registered in another log issue which I have encountered and don't want to manually have to remove sources from logs. What I decided to do was check if the source exists, if it does check that its linked to the correct log, if it isn't delete the source, now that it doesn't exist or f it never did create the Log brand new.

protected const string EventLogName = "MyLog";

private static bool CheckSourceExists(string source) {
  if (EventLog.SourceExists(source)) {
    EventLog evLog = new EventLog {Source = source};
    if (evLog.Log != EventLogName) {
      EventLog.DeleteEventSource(source);
    }
  }

  if (!EventLog.SourceExists(source)) {
    EventLog.CreateEventSource(source, EventLogName);
    EventLog.WriteEntry(source, String.Format("Event Log Created '{0}'/'{1}'", EventLogName, source), EventLogEntryType.Information);
  }

  return EventLog.SourceExists(source);
}

public static void WriteEventToMyLog(string source, string text, EventLogEntryType type) {      
  if (CheckSourceExists(source)) {          
      EventLog.WriteEntry(source, text, type);          
  }
}

Hopefully it helps :)

Answer 3

You might be forgetting to set the Source property on your EventLog.

It should look something like this:

        if(!EventLog.SourceExists("MySource"))
        {
            EventLog.CreateEventSource("MySource", "MyNewLog");
        }

        EventLog myLog = new EventLog();
        myLog.Source = "MySource";

        myLog.WriteEntry("Writing to event log.");

Here's the MSDN article for reference.

Answer 4

If you have checked all suggestions in other answers, then read the following

From MSDN

The operating system stores event logs as files. When you use EventLogInstaller or CreateEventSource to create a new event log, the associated file is stored in the %SystemRoot%\\System32\\Config directory on the specified computer. The file name is set by appending the first 8 characters of the Log property with the ".evt" file name extension.

Make sure that the first 8 characters are unique.

Answer 5

Did you set the source on your EventLog?

From MSDN Article .

You must set the Source property on your EventLog component instance before you can write entries to a log. When your component writes an entry, the system automatically checks to see if the source you specified is registered with the event log to which the component is writing, and calls CreateEventSource if needed. In general, create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources and you attempt to write an event with the new source, the write operation will fail. If creating the source during installation is not an option, then try to create the source well ahead of the first write operation, perhaps during your application initialization. If you choose this approach, be sure your initialization code is running with administrator rights on the computer. These rights are required for creating new event sources.

Answer 6

Basically, the simplest solution is you have to close your visual studio and run as administrator mode. Then, you would be able to resolve this error