Question

When I run a piece of code that I wrote I keep getting the following error:

The source was not found, but some or
all event logs could not be searched.
Inaccessible logs: Security.

I have double checked and I am not manually writing to the logs anywhere, so I assume my application is doing it on it’s own.

I found this post, which suggest that I give read/write permissions to a registry entry that corresponds to the Event Logs. I had three questions about this:

1. Is this the correct way to fix this
   error?

2. If I go this route, should I give permissions to whatever my app pool is running under? (it’s a web app)

3. Is it secure to give read/write access to that registry key?

Answer 1

This definitely seems like a permissions issue. It has to do with the fact that the Source you are trying to write into the event log does not already exist. Once it is created, this error should go away. Since you just need to make sure the Source gets added that first time, you could try the registry approach (grant access to the AppPool user), and then remove the registry access after the source has been created.

I’ve worked around this issue by manually adding the Source to the Event Log using a dialog app I wrote that I run as Administrator. Once the Source is added, all of the other event logging works fine. If you know the Source that it’s trying to use when it writes to the event log, you could try that approach as well.