.Net custom event logs.

[ASB]

Cheers,

Ah, I See. What a pile of cack. Still if thats the way it is...

So all I need is to combine "SourceExists", "LogNameFromSourceName", "DeleteEventSource" and "CreateEventSource". (At least that way I will only need to sleep when the log for a component changes).

System.Diagnostics.EventLogInstaller would be appropriate if there were ever going to be an installation, but that ain't how it's going to be deployed. It has to be cloned for a varierty of reasons. Also the event log to which a component logs is dynamic and can be changed (although this is infrequent).

Thanks for your help.

Simon.

[DimPrawn]

Have a look through this.

http://www.codeproject.com/csharp/eventlogex.asp

Of the answer to your question is due to the fact that you need to put a delay in between creating your event log and using it.

Seems Windows takes a few seconds to create the new event log.

I know it sounds bonkers but it's true (allegedly).


// Create the source, if it does not already exist.
if(!EventLog.SourceExists("MySource", "MyServer"))
{
EventLog.CreateEventSource("MySource", "MyNewLog", "MyServer");
System.Threading.Thread.Sleep(5000);
}

// Create an EventLog instance and assign its source.
EventLog myLog = new EventLog();
myLog.Source = "MySource";

// Write an informational entry to the event log.
myLog.WriteEntry("Writing to event log.");


Even more

The BEST .NET solution is not to create your custom event logs at runtime but to use the System.Diagnostics.EventLogInstaller class.

[ASB]

Yes but...

Yes, that was the pattern I was using.

But, these words could be key "You should only ever need to call CreateEventSource once."

The actual code having tried everything I can think of:-

'Delete the event source and create it.
Try
EventLog.DeleteEventSource(m_strComponent)
Catch ex As Exception
'swallow
End Try
Try
EventLog.CreateEventSource(m_strComponent, s_strLogName)
Catch ex As Exception

End Try

'Create the eventlog instance.
m_objLog = New EventLog
With m_objLog
.Log = s_strLogName
.Source = m_strComponent
End With

The try blocks are just for seeing if I get any exception etc. After the delete it doesn't show as exisiting and the create proceeds to work.

Problem seems to be that the delete doesn't actually work. It does some mapping in the registry (HKLM\CurrentControlSet\Services\EventLog\....

This all looks correct but the damn things still turn up in the Application event log (even though they are not registered to it in the registry).

Stuffed if I could find any info through the regular places I Search, it's driving me more batty than normal.

(I know write the same in C# and it'll work 'cos it ain't VB :-(
Thanks for trying though.

Simon.

[DimPrawn]

Okay, I'll post something maybe sensible.

Are you using this pattern, ie. using EventLog.SourceExists before calling CreateEventSource? You should only ever need to call CreateEventSource once.

// Create the source, if it does not already exist.
if(!EventLog.SourceExists("MySource", "MyServer")){
EventLog.CreateEventSource("MySource", "MyNewLog", "MyServer");
Console.WriteLine("CreatingEventSource");
}

// Create an EventLog instance and assign its source.
EventLog myLog = new EventLog();
myLog.Source = "MySource";

// Write an informational entry to the event log.
myLog.WriteEntry("Writing to event log.");



HTH

[DimPrawn]

Ar, you see you should be using .NET mate. That's where the future is.

[ASB]

Grr....

Anybody use these with any success?

- Check if source exists, delete it if so
- Fine
- Create source, giving it "MyName", "MyLog"
- Fine.

Now, when I write to the log - either passing the source name in the overload or by using an instance of the EventLog [yes both the source and log are set properly] - it still ends up in the application log.

However if the event source has never been registered it is fine.

What seems to be happening is that the 'CreateEventSource' call is effectively a write once call.

Any ideas.?

Simon.