Search code examples
.netwpfvb.netsecurityevent-log

Create EventLog Event Source for Standard Users


My applicaiton makes use of the Event Log to log exceptions and Informational messages, however when logged in as a Standard User who has limited access, I am receiving the Exception:

The source was not found, but some or all event logs could not be searched. Inaccessible Logs: Security

I understand that the Event Source cannot be found in the log I am writting to (Application) and the application is attempting to create the Event Source but before it can be registered all Logs need to be reviewed to make sure the Event Source isn't already in use.

My question is how should I go about creating an Event Source that can be used by Standard Users? The application will be operating on a corporate network whereby we lock down all users to the least required privellages.

I have attempted to resolve this by creating a new VS2008 Class File project that will be ran as an Administrator User that will register the EventSource, however this hasn't resolved the error. The following is my Class.

Imports System.Diagnostics
Imports System.Configuration.Install
Imports System.ComponentModel

<RunInstaller(True)> _
Public Class InstallEventLog
    Inherits Installer
    Private myEventLogInstaller As EventLogInstaller
    Public Const EventSource As String = "My Application Here"

    Public Sub New()
        myEventLogInstaller = New EventLogInstaller
        myEventLogInstaller.Source = EventSource
        myEventLogInstaller.Log = "Application"
        Installers.Add(myEventLogInstaller)
    End Sub
End Class

I then added to my Solution a setup Project which has the Primary Output of the Class Project, the setup installs however when running my application again it fails with the same error message above.


Solution

  • Depending on how "logged down" your users are the use of the "Application" Log is not possible... you should definitely try creating your own Log (not only LogSource!) and see if that works...

    IMHO the best way to solve this would be aske the administrators to create the EventSource for you via a Group Policy - this would ensure the correct rights etc.