Hello,

I've written a windows service that I am trying to get to write out to a custom log. In the partial class, it tests for and (I thought) should create a registration to the custom log:

public partial class ScriptTrigger : ServiceBase
  {
    public ScriptTrigger()
    {
      InitializeComponent();
      if (!EventLog.SourceExists("ScriptTrigger"))
      {
        EventLog.CreateEventSource("ScriptTrigger", "ScriptTrigger");
        CESourceed = true;
      }
      eventLog1.Source = "ScriptTrigger";
      eventLog1.Log = "ScriptTrigger";
    }

But, when I try to start the service I get a message saying the service has started then stopped. I've attached the debugger, and I find out that the first attempt to write to the custom log (in OnStart) is failing with this message:
"The source 'ScriptTrigger' is not registered in log 'ScriptTrigger'. (It is registered in log 'Application'). The Source and Log properties must be matched, or you may set Log to the empty string, and it will automatically be matched to the Source property."
I've tried to delete the source using this code:

static void Main(string[] args)
    {
      if (System.Diagnostics.EventLog.SourceExists("ScriptTrigger"))
      {
        EventLog.DeleteEventSource("ScriptTrigger");
      }
      else
      {
        Console.WriteLine("No ScriptTrigger Source Exists");
      }
      if (System.Diagnostics.EventLog.Exists("ScriptTrigger"))
      {
        EventLog.Delete("ScriptTrigger");
      }
      else
      {
        Console.WriteLine("No ScriptTrigger Log Exists");
      }

But it returns a SecurityException error saying the source was not found and the only inaccessable log is Security.
Can someone give me a clue as to what I'm doing wrong here?
Thanks in advance!!

Your code worked for me and it's the same with the one Microsoft provided. Make sure that the user you are logged on has enough privileges(for win7 and Vista, UAC should be turn off) Here are some tips from Microsoft about CreateEventSource.


Ionut

I have UAC turned off on my Win 7 machine. Another machine I've been testing on is server 2k3. Also, I am logged in as a user in the Administrator group. Also, I have tried installing the service by selecting 'Run as administrator'. Still no luck.
All of this code is copied from MS sites, with minor changes. I'm really having trouble understanding why it won't work. I'd had a previous version of the service logging to a generic source log name, but once I changed them to names more descriptive of the service I started having problems.
Still... Help...

Ok, it seems that the overshadowing problem is serviceProcessInstaller.Account is set to LocalService, and doesn't have sufficent capabilities to create a new log when needed. Can someone perhaps point me to documentation that will explain how to perform administrative tasks such as checking for the existance of the Source (EventLog.SourceExists()) and creating that event source?
I can work around this by first installing the service under a User account, starting then stopping the service, then uninstalling the service and re-installing it under the LocalService account; but that is far from preferable...
Or... any other recommendations of things I am missing or just ill-informed on?
Thanks.

Found the answer to my question. In finding out how simple it was, I'm a little embarassed at having even asked the question. However, I'm posting the solution in hopes it will help someone in the future.
To move the check for and creation of and event log Source to the installer (which is what I meant to ask... though looking back at the post I see that might not have been clear), all that was needed was to change the default ProjectInstaller() code
FROM:

public ProjectInstaller()
    {
      InitializeComponent();
    }

TO:

public ProjectInstaller()
    {
      InitializeComponent();
      if (!System.Diagnostics.EventLog.SourceExists("STSource"))
      {
        System.Diagnostics.EventLog.CreateEventSource("STSource", "STLog");
      }
    }

And remove that IF from the service class itself.
I had changed the Source and Event Log names - but that wasn't what gave me the desired solution.

Don't be embrassed. Your thread was very useful! It took me an painfully long time to find your solution to this. Much appreciated!

This article has been dead for over six months. Start a new discussion instead.