Custom Logs

[Guest]

Hi all

I have a little problem with custom v's application logs. I have the following method

private void WriteLog(string Message, EventLogEntryType EntType, string LogName

if (EventLog.SourceExists("TCSDirMonApp")
EventLog.DeleteEventSource("TCSDirMonApp")
EventLog.CreateEventSource("TCSDirMonApp",LogName);
EventLog applog = new EventLog(LogName)
applog.Source = "TCSDirMonApp"
applog.WriteEntry(Message,EntType)
applog.Close()
applog.Dispose()
applog=null


Where I write to either the 'Application' log or a custom log - in this case 'Landing'

WriteLog("Hello Application", EventLogEntryType.Error, "Application")
WriteLog("Hello Custom", EventLogEntryType.Error, "Landing")
WriteLog("Hello Application again", EventLogEntryType.Error, "Application")
WriteLog("Hello Custom again", EventLogEntryType.Error, "Landing")

My first issue is when I try to write to 'Landing' log, the system has not created the new log but has created a log named 'WinCE Log'
If I write to the application log it generally works OK, i.e. the messages always end up in the Application log, but they are also (sometimes) placed in the 'WinCE log'. I can't tie this down to an exact set of circumstances but I think it happens when I try to write to the applog after writing to the custom log. Almost as if the EventSource exists in more than one log - which i believe is impossible

Just putting the above an a windows form causes all 4 messages to be written to both Application and WinCE logs?????

Am I doing something really stupid or completely missing the point

Thanks in advance Pete.

 

[Guest]

The plot thickens.......

I have no idea where the WinCE log came from and why the code was writing to it - (no referances to this log anywhere in code)

Issued a EventLog.Delete("WinCE log")
restarted computer management
reran the sample in the above mail

This time 'Landing' was created but all of the messages end up in "Application" - even if I comment out the lines that wite to application

Now I am confused.........Pete.

 

[Tian Min Huang]

Hello Pete,

Thanks for your post. As I understand, the problem you are facing is that
EventLog.DeleteEventSource() does not delete event source immediately. I'd
like to share the following information with you:

As you know, EventLog.DeleteEventSource removes an application's event
source registration from the event log. The reason of this problem is that
removing a source does not remove the entries that were written to that log
using this source. However, it does affect the entries by adding
information to them indicating that the source cannot be found. Please
refer to the following MSDN articles:

Removing an Event Source
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vbcon/html/
vbtskremovingeventsource.asp

Please feel free to let me know if you have any problems or concerns.

Regards,

HuangTM
Microsoft Online Partner Support
MCSE/MCSD

Get Secure! -- www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

 

[Guest]

Tian

Thanks for the reply. You are correct that my real issue here is that the DeleteEventSource doesn't delete the event source (or similar) Immediately

I looked at the article you included a link to and I agree with the article that the events already written to the log are not removed but they are marked as the event source is missing or has moved

My issue is that even though I delete the event source from one log and then create an event source for a new log, the messages are still written to the old log until there is a reeboot or (although I have not tried this) a log off - log on

Create the test example included in the mail above - a simple windows form. I think it demonstrates the issue quite well

Thanks, Pete.

 

[Tian Min Huang]

Hi Pete,

Thanks for your reply. I reproduced the problem on my side, I am now
contacting our Developer Team to check this issue, and will update you with
their information.

Have a nice day!

Regards,

HuangTM
Microsoft Online Partner Support
MCSE/MCSD

Get Secure! -- www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

 

[Tian Min Huang]

Hi Pete,

I reviewed the documenation for the DeleteEventSource
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html
/frlrfsystemdiagnosticseventlogclassdeleteeventsourcetopic2.asp?frame=true),
which states:

"Note If a source has already been mapped to a log and you remap it to a
new log, you must reboot the computer for the changes to take effect."

This seems to indicate that once an event from that EventSource has been
written to a log you must reboot in order for the Delete+Remap in your test
below to work properly.

Does this answer your question?

Regards,

HuangTM
Microsoft Online Partner Support
MCSE/MCSD

Get Secure! -- www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

 

[Guest]

Tian

Thanks for your reply, this confirms what I thought was happening. Just wanted to make sure I wasn't missing something somewhere. Thanks for your time reproducing and researching my issue

Pete.