Hi.  I am attempting to write to a custom event log, but whenever I try, the message goes straight to the Application log.  Here's the code:

[CODE]
            if (EventLoggingEnabled)
            {
                EventLog log = new EventLog();
                log.Source = "Custom Log Security Library";
                log.WriteEntry("This is a test message.", EventLogEntryType.Information);
            }
[/CODE]

I see my message correctly displayed in the App log, but I want it to go in my custom log.  As for the registry, I have the source defined at:

HKLM/SYSTEM/CurrentControlSet/Services/EventLog/CustomLog/CustomSource.

Any idea what I'm missing here?  Thanks.

http://support.microsoft.com/kb/815314
 
in the "Create Custom Logs" section.
 

Peter,

Thanks for the response.  Actually, the article you posted was the first place I looked when I first attempted to write to the event logs.  The strange thing is that my event source is not getting "unbound" from the Application log no matter what I do.  I've deleted the custom log, deleted the source, rebooted, etc.  The code I use to create the custom source is:

[CODE]
            if (EventLoggingEnabled)
            {
                string errorMessage = string.Format(Resources.Culture, Resources.TicketCreationFailure, instanceName);
                string entryText = eventLogEntryFormatter.GetEntryText(errorMessage, e.ExceptionMessage, e.ErrorMessage);

                if (!(EventLog.SourceExists(Resources.EventSource, System.Environment.MachineName)))
                {
                    EventLog.CreateEventSource(Resources.EventSource, Resources.EventLog);
                }

                EventLog.WriteEntry(Resources.EventSource, entryText, EventLogEntryType.Information);
            }
[/CODE]

Deleting the event source produces a message in the Application log like this:

The description for Event ID ( 0 ) in Source ( ADC .NET Security Library ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: An error occurred in application WindowsAppHarness.vshost.exe in the Advertising.Security.
The authentication ticket was created for .
04/30/2007 4:10:02 PM
.
If I go into the registry and restore the missing source, I get a correct event log message, but still in the incorrect log.  Any other ideas are greatly appreciated.

Have you tried using this:
EventLog.CreateEventSource(string source, string logname);