Building off @roufamatic's powershell answer [https://stackoverflow.com/a/7154777/4582204]...
You can only call New-EventLog once or else you get
New-EventLog : The "MyApp" source is already registered on the "localhost" computer.
At line:1 char:1
+ New-EventLog -LogName Application -Source MyApp
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [New-EventLog], InvalidOperationException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.NewEventLogCommand
You might "naively" think that you could call Get-EventLog to detect if your log and source already exist. Alas, that will only tell you what events have been logged to Application MyApp; it errors on zero log events for the source, and also on source does not exist, with the same error code (bug?). Or, Get-EventLog tells you about the logs, but the source property of them is empty (bug?).
Checking whether a log source exists before creating it requires Get-WinEvent and checking whether your source is in the list of ProviderNames returned:
if (-not (Get-WinEvent -Listlog Application | where ProviderNames -contains MyApp)) {
New-EventLog -LogName Application -Source MyApp
}
To round out this topic, if you want to remove your log source, the command is (no -LogName Application needed or allowed):
Remove-EventLog -Source MyApp
Of course removing a source that does not exist also results in an error, so you may still have to check first.