194

I'm creating an ASP.NET application that will log some stuff to Windows EventLog. To do this an event source has to be created first. This requires administrative priviledges so I cannot do it in the ASP.NET app.

Is there an existing command-line application that is bundled with Windows that can create an event log source, or must I roll out my own?

10 Answers 10

324

Try "eventcreate.exe"

An example:

eventcreate /ID 1 /L APPLICATION /T INFORMATION  /SO MYEVENTSOURCE /D "My first log"

This will create a new event source named MYEVENTSOURCE under APPLICATION event log as INFORMATION event type.

I think this utility is included only from XP onwards.

Further reading

Sign up to request clarification or add additional context in comments.

8 Comments

you have to right click on "cmd" and choose "run as admin" from vista on
eventcreate records an event under an existing source, it will not create a new source from scratch as the OP requested.
@PaulChavez if the named source doesn't exist, it is created.
This won't create the event if the MYEVENTSOURCE already exists and was created using something other than eventcreate
whilst this worked and created a new source all my events all had "The description for Event ID 0 from source myApp cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted" so I had to edit the registry in the end
|
199

Try PowerShell 2.0's EventLog cmdlets. For PowerShell 2.0 and upwards:

  • Run New-EventLog once to register the event source:

      New-EventLog -LogName Application -Source MyApp
    
  • Then use Write-EventLog to write to the log:

      Write-EventLog 
          -LogName Application 
          -Source MyApp 
          -EntryType Error 
          -Message "Immunity to iocaine powder not detected, dying now" 
          -EventId 1
    

6 Comments

This works fine, just remember to run PowerShell with elevated privileges.
I had to open and close event viewer to see the new log that I created
Also if you are actively developing and New-EventLog-ing and Remove-EventLog'-ing back and forth you might encounter a problem when Source is registered but does not write to specified Log. Restarting computer helps with that. Another tip: you can see what is going on with your event logs with regedit here: [Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\]
@amackay11, while closing-and-reopening Event Viewer does work, a quicker/easier way is to simply click on its Action menu and select Refresh.
When I run this it is asking for the inputs rather than taking the values. What am I missing?
|
52

You can also use Windows PowerShell with the following command:

if ([System.Diagnostics.EventLog]::SourceExists($source) -eq $false) {
    [System.Diagnostics.EventLog]::CreateEventSource($source, "Application")
}

Make sure to check that the source does not exist before calling CreateEventSource, otherwise it will throw an exception.

For more info:

Comments

12

eventcreate2 allows you to create custom logs, where eventcreate does not.

Comments

9

If someone is interested, it is also possible to create an event source manually by adding some registry values.

Save the following lines as a .reg file, then import it to registry by double clicking it:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\YOUR_EVENT_SOURCE_NAME_GOES_HERE]
"EventMessageFile"="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\EventLogMessages.dll"
"TypesSupported"=dword:00000007

This creates an event source named YOUR_EVENT_SOURCE_NAME_GOES_HERE.

Comments

1

Or just use the command line command:

Eventcreate

Comments

1

However the cmd/batch version works you can run into an issue when you want to define an eventID which is higher then 1000. For event creation with an eventID of 1000+ i'll use powershell like this:

$evt=new-object System.Diagnostics.Eventlog(“Define Logbook”)
$evt.Source=”Define Source”
$evtNumber=Define Eventnumber
$evtDescription=”Define description”
$infoevent=[System.Diagnostics.EventLogEntryType]::Define error level
$evt.WriteEntry($evtDescription,$infoevent,$evtNumber) 

Sample:

$evt=new-object System.Diagnostics.Eventlog(“System”)
$evt.Source=”Tcpip”
$evtNumber=4227
$evtDescription=”This is a Test Event”
$infoevent=[System.Diagnostics.EventLogEntryType]::Warning
$evt.WriteEntry($evtDescription,$infoevent,$evtNumber)

Comments

1

PowerShell 7

This answer worked great in 5.x for me but not in 7.x. After some sleuthing, I got the following working:

Import-Module Microsoft.PowerShell.Management -UseWindowsPowerShell
New-EventLog -LogName Application -Source MyApp

I stumbled upon the module to import via this SO answer. Apparently, there's a set of modules you can import for Windows only cmdlet's depending upon your needs. I'm still trying to figure out how you would determine which module to import based upon your cmdlet.

Comments

1

Building off @roufamatic's powershell answer [https://stackoverflow.com/a/7154777/4582204]...

You can only call New-EventLog once or else you get

New-EventLog : The "MyApp" source is already registered on the "localhost" computer.
At line:1 char:1
+ New-EventLog -LogName Application -Source MyApp
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [New-EventLog], InvalidOperationException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.NewEventLogCommand

You might "naively" think that you could call Get-EventLog to detect if your log and source already exist. Alas, that will only tell you what events have been logged to Application MyApp; it errors on zero log events for the source, and also on source does not exist, with the same error code (bug?). Or, Get-EventLog tells you about the logs, but the source property of them is empty (bug?).

Checking whether a log source exists before creating it requires Get-WinEvent and checking whether your source is in the list of ProviderNames returned:

if (-not (Get-WinEvent -Listlog Application | where ProviderNames -contains MyApp)) {
    New-EventLog -LogName Application -Source MyApp
}

To round out this topic, if you want to remove your log source, the command is (no -LogName Application needed or allowed):

Remove-EventLog -Source MyApp

Of course removing a source that does not exist also results in an error, so you may still have to check first.

1 Comment

A more direct route for testing if the source exists [System.Diagnostics.EventLog]::SourceExists( 'MyApp' ) this returns a boolean.
-3

you can create your own custom event by using diagnostics.Event log class. Open a windows application and on a button click do the following code.

System.Diagnostics.EventLog.CreateEventSource("ApplicationName", "MyNewLog");

"MyNewLog" means the name you want to give to your log in event viewer.

for more information check this link [ http://msdn.microsoft.com/en-in/library/49dwckkz%28v=vs.90%29.aspx]

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.