Filling User Property in Eventlog Entry

Topics: Logging Application Block
Aug 9, 2007 at 9:13 AM
I really like the Enterprise Library Logging Application Block and I'm also a big fan of a centralized logging destination like the Windows Event Log. However the Windows Event Log itself gives me some pain. It makes me feel as if the code for this was still written by Bill himself. There are severe limitations as the one that one EventSource is fix bound to one EventLog (limits the Logging Application Blocks concept of categories and different trace listeners quiet a bit). Another headache is the fact that I seem not to be able to get the user that was executing the process in my event entries. I saw that this (who ever made this decision for whatever smart reason) only shows up in the Security EventLog or when its SYSTEM. If you have a productive environment with batch jobs and need to track quickly under what context a job/application was executed you will see the urge to get the user property filled in an EventLog entry. Anybody having me a guide line how to do this with Enterprise Library in some way ? It should be in the property because I need to be able to quickly filter by this information. Help is much appreciated.
Aug 9, 2007 at 12:09 PM

Unless you write code to write to the event log using PInvoke (not a trivial task) you're unfortunately out of luck. The EventLog class will always use a null user SID. Class EventLogEntry, owner of the usually null UserName property, is used for reading from the event log.