Search code examples
c#.net.net-4.0event-log

Receiving "...has already been registered..." from EventLog.CreateEventSource even though I'm checking !EventLog.SourceExists

My following code fails with "...has already been registered as a source on the local computer" even though I'm doing checks first:

lock ( eventLock )
{
    string eventLog = Constants.EventLogPL;
    string eventSrc = Constants.EventSrcPL;

    if (!EventLog.Exists(eventLog))
    {
        if (!EventLog.SourceExists(eventSrc))
        {
            try
            {
                EventLog.CreateEventSource(eventSrc, eventLog);
            }
            catch (Exception e)
            {
                System.Diagnostics.Debug.WriteLine(e.Message);
            }
        }
    }
}

I'd have thought my call to !EventLog.SourceExists would have been enough to prevent my error! I'm on 2010 .NET 4 and Windows 7 64 compiling to any CPU.

Edit: Updated code to get Constant's to locals to check they don't change, and use locking to make sure only one thread can test and create. Code still fails with the same error.

Solution

  • Found the problem after digging in to Sysinternals' Process Monitor a little more:

    Calling EventLog.Exists("MyLog");

    Logs Name not found, as expected in:

    KLM\System\CurrentControlSet\services\eventlog\MyLog

    Calling EventLog.SourceExists("MySource");

    Checks several places, name not found in as expected:

    HKLM\System\CurrentControlSet\services\eventlog\Application\MySource
    HKLM\System\CurrentControlSet\services\eventlog\HardwareEvents\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Internet Explorer\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Key Management Service\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Media Center\MySource
    HKLM\System\CurrentControlSet\services\eventlog\ODiag\MySource
    HKLM\System\CurrentControlSet\services\eventlog\OSession\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Security\MySource
    HKLM\System\CurrentControlSet\services\eventlog\System\MySource
    HKLM\System\CurrentControlSet\services\eventlog\VisualSVNServer\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Windows PowerShell\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Application\MySource
    HKLM\System\CurrentControlSet\services\eventlog\HardwareEvents\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Internet Explorer\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Key Management Service\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Media Center\MySource
    HKLM\System\CurrentControlSet\services\eventlog\ODiag\MySource
    HKLM\System\CurrentControlSet\services\eventlog\OSession\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Security\MySource
    HKLM\System\CurrentControlSet\services\eventlog\System\MySource
    HKLM\System\CurrentControlSet\services\eventlog\VisualSVNServer\MySource
    HKLM\System\CurrentControlSet\services\eventlog\Windows PowerShell\MySource
    HKLM\System\CurrentControlSet\services\eventlog\MyLog

    However, calling EventLog.CreateEventSource("MySource", "MyLog");

    Finds MyLog in the following registry location and errors:

    HKLM\System\CurrentControlSet\services\eventlog\Application\MyLog

    Removing "HKLM\System\CurrentControlSet\services\eventlog\Application\MyLog" and re-running fixed my problem!

    Looks like the .Exists don't look in all the places .CreateEvent does!