09 June 2010

Event Log Jam

While testing a service I wrote, I kept running into an exception in the area that creates a custom event log:
Only the first eight characters of a custom log name are significant, and there is already another log on the system using the first eight characters of the name given. Name given: 'MyNewService', name of existing log: 'MyNewServiceTEST'.

I made a test log, to write debug messages to the log, so i don't clutter up the production log. I have no idea why "Only the first eight characters of a custom log name are significant" in this age where 64-bit OS is the standard, but that's how it is.

The issue was resolved simply by deleting the log. Here's the syntax used to create a custom log, write an event, and delete the custom log. I placed the source and custom log names in string value types, because you'll likely want to use these throughout the application. I usually store these in a settings file, for ease of maintenance.

WARNING! Do not delete system logs! You can delete these, and will probably be displeased if you do.

Create Event Log Source:

string sourceName = "MyApp";
string logName = "MyAppLog";

// The event source must exist, before
// a custom log may be created for your application!
// This must be run using administrative privelages,
// otherwise an "access denied" exception is thrown.
if (!EventLog.SourceExists(sourceName))
    EventSourceCreationData esData = 
        new EventSourceCreationData(sourceName, logName);

Write Event Log:

EventLog evt = new EventLog(logName, ".", sourceName);
        "Test log entry submitted at: {0} {1}",

Delete Custom Log:
Note, you must be running with administrative privelages, otherwise you receive an exception stating, "Requested registry access is not allowed."


Writing to the Event Log is simple and easy!  Keep the first 8 characters of your custom event log unique, and you'll be in great shape.

1 comment:

Please provide details, when posting technical comments. If you find an error in sample code or have found bad information/misinformation in a post, please e-mail me details, so I can make corrections as quickly as possible.