Logging Error of FormattedEventLogTraceListener in Win7

Topics: Logging Application Block
Jul 4, 2012 at 5:01 AM

Currently, we are using Enterprise Library 5.0. The logging application block can work in file trance listener but nothing is logged in event log trance listener. When try to debug after download the source codes of EntLib, finally the error source is found. ProcessLog() method in LogWriterImpl class meets an exception in process event log trance listener. It seems like a security permission problem. Any suggestion to solve it?

The exception is: System.Security.SecurityException {"The source was not found, but some or all event logs could not be searched.  To create the source, you need permission to read all event logs to make sure that the new source name is unique.  Inaccessible logs: Security."}

StackTrace:  at System.Diagnostics.EventLogInternal.FindSourceRegistration(String source, String machineName, Boolean readOnly, Boolean wantToCreate)
   at System.Diagnostics.EventLogInternal.SourceExists(String source, String machineName, Boolean wantToCreate)
   at System.Diagnostics.EventLogInternal.VerifyAndCreateSource(String sourceName, String currentMachineName)
   at System.Diagnostics.EventLogInternal.WriteEvent(EventInstance instance, Byte[] data, Object[] values)
   at System.Diagnostics.EventLog.WriteEvent(EventInstance instance, Object[] values)
   at System.Diagnostics.EventLogTraceListener.TraceData(TraceEventCache eventCache, String source, TraceEventType severity, Int32 id, Object data)
   at Microsoft.Practices.EnterpriseLibrary.Logging.TraceListeners.FormattedTraceListenerWrapperBase.TraceData(TraceEventCache eventCache, String source, TraceEventType severity, Int32 id, Object data) in c:\EntLib\Entlib\Source\Blocks.Desktop\Logging\Src\Logging\TraceListeners\FormattedTraceListenerWrapperBase.cs:line 88
   at Microsoft.Practices.EnterpriseLibrary.Logging.TraceListeners.TraceListenerWrapper.TraceData(TraceEventCache eventCache, String source, TraceEventType eventType, Int32 id, Object data) in c:\EntLib\Entlib\Source\Blocks.Desktop\Logging\Src\Logging\TraceListeners\TraceListenerWrapper.cs:line 92
   at Microsoft.Practices.EnterpriseLibrary.Logging.LogSource.TraceData(TraceEventType eventType, Int32 id, LogEntry logEntry, TraceListenerFilter traceListenerFilter, TraceEventCache traceEventCache) in c:\EntLib\Entlib\Source\Blocks.Desktop\Logging\Src\Logging\LogSource.cs:line 180
   at Microsoft.Practices.EnterpriseLibrary.Logging.LogWriterImpl.ProcessLog(LogEntry log, TraceEventCache traceEventCache) in c:\EntLib\Entlib\Source\Blocks.Desktop\Logging\Src\Logging\LogWriterImpl.cs:line 557

Enviroment: Windows 7

Enterprise Library: Enterprise Library 5.0 optional update 1


Jul 4, 2012 at 6:04 AM
Edited Jul 4, 2012 at 6:04 AM

In order to write a log entry with a "new" event source (that does not exist in the event log) the event source first needs to be created.  When writing an entry this happens under the covers but this does require administrative permission: "To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges." So, if the program does not have administrative permission (always a good idea!), then you will need to create the event source before the application can write to the event log.  This can be done during deployment using an installer, or powershell for example.

Randy Levy
Enterprise Library support engineer