EventLog.SourceExists enumerates through the subkeys of HKLM\SYSTEM\CurrentControlSet\services\eventlog to see if it contains a subkey with the specified name. If the user account under which the code is running does not have read access to a subkey that it attempts to access (in your case, the Security subkey) before finding the target source, you will see … Read more
I got this error after creating an event source under the Application Log from the command line using “EventCreate”. This command creates a new key under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application If you look at the Key that’s been created (e.g. SourceTest) there will be a string value calledEventMessageFile, which for me was set to %SystemRoot%\System32\EventCreate.exe. Change this to … Read more
Wix has out-of-the-box support for creating event log sources. Assuming you use Wix 3, you first need to add a reference to WixUtilExtension to either your Votive project or the command line. You can then add an EventSource element under a component : <Wix xmlns=”http://schemas.microsoft.com/wix/2006/wi” xmlns:util=”http://schemas.microsoft.com/wix/UtilExtension”> <Component …> … <util:EventSource Log=”Application” Name=”*source name*” EventMessageFile=”*path to … Read more
I cant remember where I found this code but its an alternative to using pInvoke which I think is a bit overkill for this task. Use the FileSystemWatcher to watch the folder and when an event fires you can work out which user made the file change using this code: private string GetSpecificFileProperties(string file, params … Read more
Yes, there is a way to write to the event log you are looking for. You don’t need to create a new source, just simply use the existent one, which often has the same name as the EventLog’s name and also, in some cases like the event log Application, can be accessible without administrative privileges*. … Read more
Try “eventcreate.exe” An example: eventcreate /ID 1 /L APPLICATION /T INFORMATION /SO MYEVENTSOURCE /D “My first log” This will create a new event source named MYEVENTSOURCE under APPLICATION event log as INFORMATION event type. I think this utility is included only from XP onwards. Further reading Windows IT Pro: JSI Tip 5487. Windows XP includes … Read more
To give Network Service read permission on the EventLog/Security key (as suggested by Firenzi and royrules22) follow instructions from http://geekswithblogs.net/timh/archive/2005/10/05/56029.aspx Open the Registry Editor: Select Start then Run Enter regedt32 or regedit Navigate/expand to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security Right click on this entry and select Permissions Add the Network Service user Give it Read permission … Read more