Writing to a custom event log

[Alex Fedotov]

Hello,

I am trying to write to a custom event log from a process that runs as a
regular user, not an administrator. I am receiving
System.Security.SecurityException with the additional information that
"requested registry access is not allowed". The call stack is as follows:

mscorlib.dll!Microsoft.Win32.RegistryKey.OpenSubKey(string name =
"Security", bool writable = false) + 0x221 bytes
system.dll!System.Diagnostics.EventLog.FindSourceRegistration(string source
= "Common Library", string machineName = ".", bool readOnly = true) + 0x1a2
bytes
system.dll!System.Diagnostics.EventLog.SourceExists(string source = "Common
Library", string machineName = ".") + 0xd9 bytes
system.dll!System.Diagnostics.EventLog.WriteEntry(string message = "...",
System.Diagnostics.EventLogEntryType type = Warning, int eventID = 0x0,
short category = 0x0, byte[] rawData = <undefined value>) + 0x160 bytes
system.dll!System.Diagnostics.EventLog.WriteEntry(string message = "...",
System.Diagnostics.EventLogEntryType type = Warning, int eventID = 0x0,
short category = 0x0) + 0x20 bytes
acme.common.dll!Acme.Common.Log.Write(string source = "Common Library",
System.Diagnostics.EventLogEntryType type = Warning, string format = "...",
System.Object[] args = {Length=0x2}) Line 104 + 0x15 bytes

As it can be seen from the call stack, it is the EventLogSourceExists method
that fails. As far as I understand the logic of this method, it opens all
registry keys below the EventLog service key looking for the specified event
source. When running as a regular user, not surprisingly, it fails to open
the registry key of the Security event log.

I see this as a bug in the .NET Framework, as it makes nearly impossible to
write events to a custom event log (writing to the Application log works,
probably because the Application key gets enumerated prior to the Security
key).

Can anyone confirm that such a problem exists? Is there any workaround
except than using P/Invoke to call the old good ReportEvent API?

-- Alex Fedotov

 

[John M Deal]

I took a look at the code for the
System.Diagnostics.EventLog.FindSourceRegistration and from what I was
able to determine it looks like this is a bug in the code, however you
can get around it if you create a custom event log whose name starts
with a letter in the alphabet before "S". What happens it that
FindSourceRegistration iterates over each sub key until it runs out of
sub keys to check OR until it finds the one you are looking for.

If you make sure to create an event log that starts alphabetically
before the letter "S" and you make sure to create the event log during
your application's installation you will be able to get around this
problems.

Also after checking on things it turns out that Microsoft is aware of
this bug, though I don't know if they are going to do anything about it
any time soon.

Have A Better One!

John M Deal