CODEWITHSUNDEEP
c#.net
user850010
user850010

Reputation: 6359

Problem when trying to use EventLog.SourceExists method in .NET

I am trying to use eventlogs in my application using C#, so I added the following code

if (!EventLog.SourceExists("SomeName"))
EventLog.CreateEventSource("SomeName", "Application");

The EventLog.SourceExists causes SecurityException that says
"The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security."

I am running as administrator in Windows 7.

Any help would be appriciated.

Upvotes: 31

Views: 38869

Answers (4)

Granger
Granger

Reputation: 4409

Yes, it's a permissions issue, but it's actually worse than indicated by the currently accepted answer. There are actually 2 parts.

Part 1

In order to use SourceExists(), the account that your code is running under must have "Read" permission for the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog key and it must also have "Read" permissions on each of the descendant-keys. The problem is that some of the children of that key don't inherit permissions, and only allow a subset of accounts to read them. E.g. some that I know about:

  • Security
  • State
  • Virtual Server

So you have to also manually change those when they exist.

FYI, for those keys (e.g. "State") where even the Administrator account doesn't have "Full Access" permission, you'll have to use PsExec/PsExec64 to "fix" things. As indicated in this StackOverflow answer, download PsTools. Run this from an elevated command prompt: PsExec64 -i -s regedit.exe and you'll them be able to add the permissions you need to that key.

Part 2

In order to successfully use CreateEventSource(), the account that your code is running under must have "Full Control" permissions on HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog as well as have "Full Control" permissions on the log you're adding the new source to.

But wait, there's more...

It is also important to know that both CreateEventSource() and WriteEntry() call SourceExists() "under the hood". So ultimately, if you want to use the EventLog class in .Net, you have to change permissions in the registry. The account needs "Full Control" on the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog key and "Read" for all children.

Commentary: And I believe all of this mess is because when Microsoft originally designed the EventLog, they decided it was critical that people would be able to log something by "Source" without needing to know what log that "Source" went with.

Upvotes: 11

Ronaldo Moreira
Ronaldo Moreira

Reputation: 1037

Good afternoon, The simplest is that you run vs2019 as an administrator, so when debugging or excute the service, it will run correctly without generating the exception.

Upvotes: 0

Jacek Cz
Jacek Cz

Reputation: 1906

Short tip:

One event source is registered during Service instalation (if application is Windows Service), and can be used without Security Exception with low-profile process owner (not Administrator)

I perform service installation / run with C# code in typical way from SO/ MSDN

Important is property ServiceName in class System.ServiceProcess.ServiceBase .

Upvotes: 3

Justin
Justin

Reputation: 86789

This is a permissions problem - you should give the running user permission to read the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog

Alternaitvely you can bypas the CreateEventSource removing the need to access this registry key.

Both solutions are explained in more detail in the following thread - How do I create an Event Log source under Vista?.

Upvotes: 19

Related Questions