Question

I’m attempting to set up basic logging to the windows event log in .net via System.Diagnostics.EventLog, but I’m failing to see any events actually getting written to the log. Consider the following code:

// Elsewhere in the class
private static readonly string EventLogName = "LogName";
private static readonly string EventLogSource = "AppName";

// In the only function that does something
if (!EventLog.Exists(EventLogName))
{
    EventLog.CreateEventSource(EventLogSource, EventLogName);
    return;
}
else
{
    Trace.TraceInformation("Attempting log");

    // This doesn't write anything
    EventLog.WriteEntry(EventLogSource, 
        "StaticWriteEntry", 
        EventLogEntryType.Error);

    // Neither does this
    using (var log = new EventLog())
    {
        log.Log = EventLogName;
        log.Source = EventLogSource;
        log.WriteEntry("WriteEntry?", EventLogEntryType.Error);
    }
}
return;

The first time through I create the log and exit the app, per the MSDN sample. This log creation will eventually go into the setup, of course. Subsequent runs attempt to log a message to the created eventlog.

No exceptions are being thrown. The log appears to be successfully created (I can open it in the Windows Event Viewer). Nothing relevant is being logged to the Security log.

No messages are logged via either WriteEntry(). They aren’t placed in the Application log due to a mismatched name, either. In this particular case, I’m running on Server2008 in an admin account with UAC disabled. (This is a small piece of a larger legacy product that requires the unfortunate environment.) What am I doing wrong?

(I’m doing this because I want to use an EventLogTraceListener in my app.config, and it wasn’t writing anything, so this is part of troubleshooting that problem.)

Answer 1

The problem seems to be related to the source name. Specifically, if I change the source name, I can successfully write. This is due to the following line at the bottom of the the EventLog.Source docs:

If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

In the course of development, the log name and log source have been created and destroyed a couple times, and I may have changed the logname without changing the source name.

Assume that my original source and log were "OldSource" and "OldLog". I determined that this may be the source of the problem by changing the code to attempt to write to "NewSource" and "NewLog". When I changed both, I successfully created and wrote to "NewLog". When I tried writing to "NewLog" by creating it with "OldSource", however, it failed.

I confirmed that this was the problem by then rebooting my development system and running the exact same code (with "NewLog" and "OldSource") and it worked.

I guess this is one time where rebooting actually did fix it! 🙂