I'm trying to unit-test a library which writes to the EventLog. In every test the library checks if the test-source already exists (always using the same source name in these tests) and otherwise creates it.
Now I noticed strange behavior when these tests are running on buid agents: Lets say we have following test-data: EventSource: TestSource ProtocolName: TestName
After the tests have run (and most of the time, except on new agents, many tests fail because the EntryWritten-Event of the EventLog is not fired any more) the suddenly are following two EventProtocols: TestName, TestName2
But I just can`t figure out when and why this second protocol is created. Does anybody know this behaviour?
Thanks in advance!
I managed to solve the problem.
Embarrassingly I missed a test, which creates this protocol. I even could not find it by search.
I also managed to implement an acceptable cleanup method (I had to stop the eventlog service in order to delete evtx files).
Edit: If anyone has the same problem: Note that stopping the eventlog service also stops schedule (so it must also be manually restarted when restarting eventlog).