Writing to custom event log.

Hi.  I am attempting to write to a custom event log, but whenever I try, the message goes straight to the Application log.  Here's the code:

[CODE]
            if (EventLoggingEnabled)
            {
                EventLog log = new EventLog();
                log.Source = "Custom Log Security Library";
                log.WriteEntry("This is a test message.", EventLogEntryType.Information);
            }
[/CODE]

I see my message correctly displayed in the App log, but I want it to go in my custom log.  As for the registry, I have the source defined at:

HKLM/SYSTEM/CurrentControlSet/Services/EventLog/CustomLog/CustomSource.

Any idea what I'm missing here?  Thanks.

http://support.microsoft.com/kb/815314

 

in the "Create Custom Logs" section.

 

Peter,

Thanks for the response.  Actually, the article you posted was the first place I looked when I first attempted to write to the event logs.  The strange thing is that my event source is not getting "unbound" from the Application log no matter what I do.  I've deleted the custom log, deleted the source, rebooted, etc.  The code I use to create the custom source is:

[CODE]
            if (EventLoggingEnabled)
            {
                string errorMessage = string.Format(Resources.Culture, Resources.TicketCreationFailure, instanceName);
                string entryText = eventLogEntryFormatter.GetEntryText(errorMessage, e.ExceptionMessage, e.ErrorMessage);

                if (!(EventLog.SourceExists(Resources.EventSource, System.Environment.MachineName)))
                {
                    EventLog.CreateEventSource(Resources.EventSource, Resources.EventLog);
                }

                EventLog.WriteEntry(Resources.EventSource, entryText, EventLogEntryType.Information);
            }
[/CODE]

Deleting the event source produces a message in the Application log like this:

The description for Event ID ( 0 ) in Source ( ADC .NET Security Library ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: An error occurred in application WindowsAppHarness.vshost.exe in the Advertising.Security.
The authentication ticket was created for .
04/30/2007 4:10:02 PM
.
If I go into the registry and restore the missing source, I get a correct event log message, but still in the incorrect log.  Any other ideas are greatly appreciated.

Have you tried using this:

EventLog.CreateEventSource(string source, string logname);

 

 

Once you create an event source, you cannot reuse that event source name. The framework searches through all of the event sources on the machine, and if it finds one that matches the name, it uses it. To make the code work properly, you need to create a new event source.