Home/ Questions/Q 54281
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-10T17:11:44+00:00

The System.Diagnostics.EventLog class provides a way to interact with a windows event log. I

  • 0

The System.Diagnostics.EventLog class provides a way to interact with a windows event log. I use it all the time for simple logging…

System.Diagnostics.EventLog.WriteEntry('MyEventSource', 'My Special Message')

Is there a way to set the user information in the resulting event log entry using .NET?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Toughie …

    I looked for a way to fill the user field with a .NET method. Unfortunately there is none, and you must import the plain old Win32 API [ReportEvent function](http://msdn.microsoft.com/en-us/library/aa363679(VS.85).aspx) with a DLLImportAttribute

    You must also redeclare the function with the right types, as Platform Invoke Data Types says

    So

    BOOL ReportEvent( __in  HANDLE hEventLog, __in  WORD wType, __in  WORD wCategory, __in  DWORD dwEventID, __in  PSID lpUserSid, __in  WORD wNumStrings, __in  DWORD dwDataSize, __in  LPCTSTR *lpStrings, __in  LPVOID lpRawData );

    becomes

    [DllImport('Advapi32.dll', EntryPoint='ReportEventW',  SetLastError=true, CharSet=CharSet.Unicode)] bool WriteEvent(   IntPtr hEventLog, //Where to find it ?   ushort  wType,   ushort  wCategory,   ulong dwEventID,   IntPtr lpUserSid, // We'll leave this struct alone, so just feed it a pointer   ushort wNumStrings,   ushort dwDataSize,   string[] lpStrings,   IntPtr lpRawData );

    You also want to look at [OpenEventLog](http://msdn.microsoft.com/en-us/library/aa363672(VS.85).aspx) and [ConvertStringSidToSid](http://msdn.microsoft.com/en-us/library/aa376402(VS.85).aspx)

    Oh, and you’re writing unmanaged code now… Watch out for memory leaks.Good luck :p

    • 0