Home/ Questions/Q 938699
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T21:41:03+00:00

My following code fails with …has already been registered as a source on the

  • 0

My following code fails with “…has already been registered as a source on the local computer” even though I’m doing checks first:

lock ( eventLock )
{
    string eventLog = Constants.EventLogPL;
    string eventSrc = Constants.EventSrcPL;

    if (!EventLog.Exists(eventLog))
    {
        if (!EventLog.SourceExists(eventSrc))
        {
            try
            {
                EventLog.CreateEventSource(eventSrc, eventLog);
            }
            catch (Exception e)
            {
                System.Diagnostics.Debug.WriteLine(e.Message);
            }
        }
    }
}

I’d have thought my call to !EventLog.SourceExists would have been enough to prevent my error!
I’m on 2010 .NET 4 and Windows 7 64 compiling to any CPU.

Edit: Updated code to get Constant’s to locals to check they don’t change, and use locking to make sure only one thread can test and create. Code still fails with the same error.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Found the problem after digging in to Sysinternals’ Process Monitor a little more:

    Calling EventLog.Exists("MyLog");

    Logs Name not found, as expected in:

    KLM\System\CurrentControlSet\services\eventlog\MyLog

    Calling EventLog.SourceExists("MySource");

    Checks several places, name not found in as expected:

    HKLM\System\CurrentControlSet\services\eventlog\Application\MySource
    HKLM\System\CurrentControlSet\services\eventlog\HardwareEvents\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Internet Explorer\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Key Management Service\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Media Center\MySource
    HKLM\System\CurrentControlSet\services\eventlog\ODiag\MySource
    HKLM\System\CurrentControlSet\services\eventlog\OSession\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Security\MySource
    HKLM\System\CurrentControlSet\services\eventlog\System\MySource
    HKLM\System\CurrentControlSet\services\eventlog\VisualSVNServer\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Windows PowerShell\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Application\MySource
    HKLM\System\CurrentControlSet\services\eventlog\HardwareEvents\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Internet Explorer\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Key Management Service\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Media Center\MySource
    HKLM\System\CurrentControlSet\services\eventlog\ODiag\MySource
    HKLM\System\CurrentControlSet\services\eventlog\OSession\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Security\MySource
    HKLM\System\CurrentControlSet\services\eventlog\System\MySource
    HKLM\System\CurrentControlSet\services\eventlog\VisualSVNServer\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Windows PowerShell\MySource
    HKLM\System\CurrentControlSet\services\eventlog\MyLog

    However, calling EventLog.CreateEventSource("MySource", "MyLog");

    Finds MyLog in the following registry location and errors:

    HKLM\System\CurrentControlSet\services\eventlog\Application\MyLog

    Removing “HKLM\System\CurrentControlSet\services\eventlog\Application\MyLog” and re-running fixed my problem!

    Looks like the .Exists don’t look in all the places .CreateEvent does!

    • 0