Question

I’m using EventLog to support a logging class in my C# application. (Previously…) Here’s a whittled down copy of that class:

class Logger
{
    private EventLog eventLog;
    private ListView listViewControl = null;
    private String logSource = "SSD1";

    public Logger(ListView _listViewControl = null, string _logFileName = null)
    {
        if (!EventLog.SourceExists("SSD1"))
            EventLog.CreateEventSource(logSource, "Application");
        eventLog = new EventLog();
        eventLog.Source = logSource;
        addListView(_listViewControl);
        logFilename = _logFileName;
    }

    public void addListView(ListView newListView)
    {
        if (eventLog.Entries.Count > 0)
        {
            foreach (EventLogEntry entry in eventLog.Entries)
            {
                listViewControl.Items.Add(buildListItem(entry));
            }
        }
    }

    public void LogInformation(string message)
    {
        LogEntry(message, EventLogEntryType.Information);
    }

    private void LogEntry(string message, EventLogEntryType logType)
    {
        eventLog.WriteEntry(message, logType);
        if (listViewControl != null)
        {
            updateListView();
        }
    }

    private void updateListView()
    {
        listViewControl.Items.Add(buildListItem(eventLog.Entries[eventLog.Entries.Count-1]));
    }

    private ListViewItem buildListItem(EventLogEntry entry)
    {
        string[] eventArray = new string[3];
        eventArray[0] = entry.Message + " (" + entry.Source +")";
        eventArray[1] = entry.EntryType.ToString();
        eventArray[2] = entry.TimeGenerated.ToString("dd/MM/yyyy - HH:mm:ss");
        return new ListViewItem(eventArray);
    }

The problem is, the ListView gets populated with the whole of the log – not just those from the specified source. Here’s a screenshot of the output:

Entries from all sources http://img341.imageshack.us/img341/6185/entriesfromalllogs.png

(In this image, the source of each entry is in brackets after the message.)

How do I get the EventLog to return only those entries from my source? Have I misunderstood EventLog completely?

Answer 1

The EventLog.Source member doesn’t work as a filter. According to the MSDN documentation for EventLog

To read from a log, specify the Log
name and MachineName (server computer
name) for the EventLog. It is not
necessary to specify the Source, as a
source is required only for writing to
logs. The Entries member is
automatically populated with the event
log’s list of entries.

Because you do not specify a string for the Log member of the EventLog instance, it is getting everything.

Off the top of my head, there are a couple of ways to deal with this.

First, modify buildListItem() to filter on your source name. This is relatively straightforward.

Second, create your own log. Instead of logging to the Application log, create a log specifically for your application. You can do this by altering your constructor:

public Logger(ListView _listViewControl = null, string _logFileName = null)   
{   
    if (!EventLog.SourceExists("SSD1"))   
        EventLog.CreateEventSource("SSD1", "TomWrightApplication");   
    eventLog = new EventLog("TomWrightApplication", ".", "SSD1");
    addListView(_listViewControl);   
    logFilename = _logFileName;   
}   

All logging will now go to the TomWrightApplication log, not the generic Application log.

---

Tom, I’ve got a test project that simply does the following:

static void Main()
{
    if (!EventLog.SourceExists("SSD1"))
        EventLog.CreateEventSource("SSD1", "SSDAppLog");
    EventLog log = new EventLog("SSDAppLog", ".", "SSD1");
    log.WriteEntry("this is a test");
}

This works successfully unless…the SSD1 source name is already registered with another log. As I understand it, the source name must be unique across all event logs. So, if you’ve already registered SSD1 with the Application log, the above code will fail when creating the new EventLog. Try using the EventLog.DeleteEventSource() to remove the SSD1 source name from the Application log (just run this one time for your system). The above code should work then (assuming you have admin privileges).