EventViewer

[Mr. X.]

Problem with eventViewer :

I see the sample on http://support.microsoft.com/kb/307024

When I do with the same parameters as above :
if (!(EventLog.SourceExists(sSource)))
{
EventLog.CreateEventSource(sSource, sLog);
}

I got an exception :
{"The source was not found, but some or all event logs could not be
searched. Inaccessible logs: Security."} System.SystemException
{System.Security.SecurityException}

Thanks

 

[Mr. X.]

At the example I gave, source is : "dotNET Sample App".
I don't understand much about eventViewer.
What should I do or check about in order to have sufficient access
privileges to be permitted to access the source ?

Thanks

 

[Mr. X.]

I didn't reach the line that I refer to "Log".
The exception is on the line :
if (!(EventLog.SourceExists(sSource)))

Please, give me an example how running my code, in order not getting the
exception.

Thanks

 

[Jeff Johnson]

I didn't reach the line that I refer to "Log".
The exception is on the line :
if (!(EventLog.SourceExists(sSource)))

Please, give me an example how running my code, in order not getting the
exception.

From the MSDN documentation on SourceExists(String):

=======
Because this method accesses the registry, you must have the appropriate
registry permissions on the local computer; otherwise, a SecurityException
will be thrown.

Note:
To search for an event source in Windows Vista, Windows XP Professional , or
Windows Server 2003, you must have administrative privileges.

The reason for this requirement is that all event logs, including security,
must be searched to determine whether the event source is unique. In Windows
Vista, users do not have permission to access the security log; therefore, a
SecurityException is thrown.

In Windows Vista, User Account Control (UAC) determines the privileges of a
user. If you are a member of the Built-in Administrators group, you are
assigned two run-time access tokens: a standard user access token and an
administrator access token. By default, you are in the standard user role.
To execute the code that accesses performance counters, you must first
elevate your privileges from standard user to administrator. You can do this
when you start an application by right-clicking the application icon and
indicating that you want to run as an administrator.

Note:
A service that is executing under the LocalSystem account does not have the
privileges required to execute this method. The solution is to check whether
the event source exists in the ServiceInstaller, and if it does not exist,
to create the source in the installer.
=======

 

[Mr. X.]

O.K.
I have Windows 7.
VS. 2008.

What I want, that each exception will be thrown elegantly :
I mean that for exception there will be an hint on the status-bar, which
user can click, and expend the exception message.
Each exception I write on the event-viewer.
I don't know whether the above is a good solution, indeed.

On : Control Panel\User Accounts and Family Safety\User Accounts, I see that
my account is declared as administrator.
I didn't see a way to run my application with administrator privileges,
neither on the VS.2008 IDE.

Thanks

 

[Mr. X.]

Does every writing to EventViewer is access the security log ?
I just want to write message to event-viewer.
If not - what is the new suggested attitude writing message/errors instead
of writing to event viewer?
(I am stacked on the line :
if (!(EventLog.SourceExists(sSource)))
only when debugging C# VS.2008)

Thanks

 

[Mr. X.]

O.K.
I didn't know that EventLog.SourceExists search all the events (and I didn't
find any way not doing so).
I need to write into EventViewer.
I don't know what should I put in EventLog.SourceExists parameters, in
order to search a specific log.
SourceExists takes at the first parameter : source.
At the second parameter (optional) : current machine.
Should I declare the log (or source, whatever)?
Should I register some source/log?
How can I do that?
I didn't find any clue how doing that, even on the internet.

Thanks

 

[Mr. X.]

Partial solved :
I did for a specific log, and specific source, which are always exists
(I didn't find a way to create a source).
The source : "Application Error"
The log : "Application"

I see the error on event-viewer, but event-id = 0. Why ?

The program can run for now with no security problems.

Thanks

 

[Mr. X.]

Should I send an event-id, or 0 is O.K ?

Partial solved :
I did for a specific log, and specific source, which are always exists
(I didn't find a way to create a source).
The source : "Application Error"
The log : "Application"

I see the error on event-viewer, but event-id = 0. Why ?

The program can run for now with no security problems.

Thanks

 

[Mr. X.]

Well,
I think if there is no necessary for calculation eventId (there is no event
ID),
and whether I use a specific Source & Log : "Application", "Application Log"
respectively,
(you should say so from the beginning),
problem is solved.

Thanks