Problem when trying to use EventLog.SourceExists method in .NET

Question

I am trying to use eventlogs in my application using C#, so I added the following code

if (!EventLog.SourceExists(\"SomeName\"))
EventLog.CreateEventSource(\         


        

Answer 1

This is a permissions problem - you should give the running user permission to read the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog

Alternaitvely you can bypas the CreateEventSource removing the need to access this registry key.

Both solutions are explained in more detail in the following thread - How do I create an Event Log source under Vista?.

Answer 2

Short tip:

One event source is registered during Service instalation (if application is Windows Service), and can be used without Security Exception with low-profile process owner (not Administrator)

I perform service installation / run with C# code in typical way from SO/ MSDN

Important is property ServiceName in class System.ServiceProcess.ServiceBase .

Answer 3

Yes, it's a permissions issue, but it's actually worse than indicated by the currently accepted answer. There are actually 2 parts.

Part 1

In order to use SourceExists(), the account that your code is running under must have "Read" permission for the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog key and it must also have "Read" permissions on each of the descendant-keys. The problem is that some of the children of that key don't inherit permissions, and only allow a subset of accounts to read them. E.g. some that I know about:

• Security
• State
• Virtual Server

So you have to also manually change those when they exist.

FYI, for those keys (e.g. "State") where even the Administrator account doesn't have "Full Access" permission, you'll have to use PsExec/PsExec64 to "fix" things. As indicated in this StackOverflow answer, download PsTools. Run this from an elevated command prompt: PsExec64 -i -s regedit.exe and you'll them be able to add the permissions you need to that key.

Part 2

In order to successfully use CreateEventSource(), the account that your code is running under must have "Full Control" permissions on HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog as well as have "Full Control" permissions on the log you're adding the new source to.

But wait, there's more...

It is also important to know that both CreateEventSource() and WriteEntry() call SourceExists() "under the hood". So ultimately, if you want to use the EventLog class in .Net, you have to change permissions in the registry. The account needs "Full Control" on the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog key and "Read" for all children.

Commentary: And I believe all of this mess is because when Microsoft originally designed the EventLog, they decided it was critical that people would be able to log something by "Source" without needing to know what log that "Source" went with.

Answer 4

Good afternoon, The simplest is that you run vs2019 as an administrator, so when debugging or excute the service, it will run correctly without generating the exception.