An Application Needs to Create An Event Source in the Event Log

Spent about 6 hours today resolving the issue about writing events into the custom Event Log. Usual deal - application happily writes everything I ask it to write on my PC, but of course the client installs the application and nothing is logged. Turns out that the issue is well researched and is happening when the application is running under the account that does not have permissions to the EventLog entry in the registry, which can be verified by checking the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog" node permissions

The custom event log is not created and the events are not getting logged but there is no exception raised so it's not obvious at the first glance what is happening. And I had to obtain a separate test login to replicate the behaviour.

There are several approaches and details may vary.

• The easiest and probably the most dangerous is to just give the users full control to the registry key.
• Or you could just tell the user to only run the application when a member of Administrators group is logged on.
• Or you could create the event log and source manually or using some tool for each installation.
• A more proper and not so straightforward approach is to create the custom event log when the application is being installed. Generally I followed the steps described here

Create a New Event Source in the Event Log

• Created a new project in my solution of the type Class Library
• Added the code for the class that inherits from System.Configuration.Install.Installer and creates the event log
• Built the project

Next, however, the author suggested to directly use the resulting dll to create the event log by running the InstallUtil. That's not what I want my clients to go through, so I switched to another solution from here:

Walkthrough: Installing an Event Log Component

• Added the output from my Class Library to the Setup and Deployment project
• Created a custom action and assigned the output to the custom action
• Built the Setup and Deployment project

Early testing shows so far that now you have to be an Administrator to install the application. But the event log is created at the time of installation, while previously it was not created until the event had to be logged first time. And in the future any user can use that event log.

This page, by the way, suggested overriding the Install and Uninstall methods in the class that creates the event log, unlike the one I used, where the log is created right in the class constructor. But I didn't get deep enough to understand the benefit of this approach:

Building Custom Installer Classes in .NET

by Evgeny. Also posted on my website