17.3 Write an Event to the Windows Event Log

Problem

You need to write an event to the Windows event log.

Solution

Use the members of the System.Diagnostics.EventLog class to create a log (if required), register an event source, and write events.

Discussion

You can write to the Windows event log using the static methods of the EventLog class, or you can create an EventLog object and use its members. Whichever approach you choose, before writing to the event log you must decide which log you will use and register an event source against that log. The event source is simply a string that uniquely identifies your application. An event source may be registered against only one log at a time.

By default, the event log contains three separate logs: Application, System, and Security. Usually, you will write to the Application log, but you might decide that your application warrants a custom log in which to write events. You do not need to explicitly create a custom log; when you register an event source against a log, if the specified log doesn't exist, it's created automatically.

Once you have decided on the destination log and registered an event source, you can start to write event log entries using the WriteEntry method. WriteEntry provides a variety of overloads that allow you to specify some or all of the following values:

• A string containing the event source for the log entry ( static versions of WriteEntry only).

• A string containing the message for the log entry.

• A value from the System.Diagnostics.EventLogEntryType enumeration, which identifies the type of log entry. Valid values are Error , FailureAlert , Information , SuccessAudit , and Warning.

• An int that specifies an application-specific event ID for the log entry.

• A short that specifies an application-specific subcategory for the log entry.

• A byte array containing any raw data to associate with the log entry.

The EventLog class shown here demonstrates the use of the static members of EventLog class to write an entry to the event log of the local machine. The methods of the EventLog class also provide overloads that support the writing events to the event log of remote machines; see the .NET Framework SDK documentation for more information.

 using System; using System.Diagnostics; public class EventLogExample {     public static void Main () {         // If it does not exist, register an event source for this         // application against the Application log of the local machine.         // Trying to register an event source that already exists on the          // specified machine will throw a System.ArgumentException.         if (!EventLog.SourceExists("EventLogExample")) {             EventLog.CreateEventSource("EventLogExample","Application");         }         // Write an event to the event log.         EventLog.WriteEntry(             "EventLogExample",             // Registered event source             "A simple test event.",        // Event entry message             EventLogEntryType.Information, // Event type             1,                             // Application specific ID             0,                             // Application specific category             new byte[] {10, 55, 200}       // Event data         );         // Wait to continue.         Console.WriteLine("Main method complete. Press Enter.");         Console.ReadLine();     } }