Re: custom event log

From: Joe Kaplan \(MVP - ADSI\) (joseph.e.kaplan_at_removethis.accenture.com)
Date: 06/24/05


Date: Fri, 24 Jun 2005 08:51:52 -0500

Generally, what I do is this:

In a separate application run by the admin, do something that calls
EventLog.CreateEventSource like Dominick suggested. Sometimes this is a
simple app. Another easy way to do it is to have an EventLogInstaller class
in your assembly and have the admin run InstallUtil.exe on your assembly.
This will run the installer class and create the event source.

Then, from my code, I would have something that simply calls
EventLog.WriteEntry, passing in the source you created in the step above,
the message string, log type and eventID if I wanted to use event IDs.

That is generally enough to get this working. There are a variety of other
deployment options including MSI and creating your own message files, but
this will give you basic event log functionality.

HTH,

Joe K.
<dl> wrote in message news:eCQ9S1IeFHA.3864@TK2MSFTNGP10.phx.gbl...
> I'll try, meanwhile, can you tell me what have you don't? may be that's
> all
> I need?! what do you mean by "write strings and numbers for eventIDs"?
> TIA
>
> "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com> wrote
> in message news:ehhabMHeFHA.584@TK2MSFTNGP15.phx.gbl...
>> You are asking the wrong guy (and probably the wrong newsgroup). I've
> never
>> gotten that deep into event log stuff. The most I've ever done is just
>> write strings and numbers for eventIDs and that has been all I've needed.
>>
>> Maybe one of the platform sdk groups?
>>
>> Joe K.
>>
>> <dl> wrote in message news:upfh4iGeFHA.3488@tk2msftngp13.phx.gbl...
>> > How can we use the standard message file or specifically the Category /
>> > eventID? Can we customize this standard message file?
>> > TIA
>> > "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com>
> wrote
>> > in message news:eUQZCgFeFHA.3616@TK2MSFTNGP09.phx.gbl...
>> >> The only thing I'm aware of is the MSDN platform SDK documentation.
>> >> As
> I
>> >> understand it, you need to use the message compiler to do it, but I've
>> > never
>> >> done it and have no experience with it.
>> >>
>> >> As I understand it, when you create an event source with .NET, you'll
> get
>> >> the standard .NET framework message file associated with it.
>> >>
>> >> Joe K.
>> >>
>> >> <dl> wrote in message news:%23IA5KVFeFHA.1356@TK2MSFTNGP10.phx.gbl...
>> >> > Is there any good reference in showing how to make my own message
> file
>> >> > (category / eventID)?
>> >> > TIA
>> >> >
>> >> > "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com>
>> > wrote
>> >> > in message news:%23yJDJXCeFHA.640@tk2msftngp13.phx.gbl...
>> >> >> There are a variety of ways, depending on how you want to do your
>> >> >> deployment. You might write a simple console app that does this
> that
>> > the
>> >> >> admin runs when they install your app. You can also be more fancy
> and
>> >> >> integrate this into a Windows installer package. Lots of options.
>> >> >>
>> >> >> Joe K.
>> >> >>
>> >> >> <dl> wrote in message
> news:%23vtWrtAeFHA.2700@tk2msftngp13.phx.gbl...
>> >> >> > Hi Joe / Dominick
>> >> >> > Sorry, I found it under 1.1. I just need to know how to do it in
>> >> >> > the
>> >> >> > deployment process?! This is my first .NET application!
>> >> >> >
>> >> >> > "Dominick Baier [DevelopMentor]"
>> > <dbaier@pleasepleasenospamdevelop.com>
>> >> >> > wrote in message
> news:512812632551441528877534@news.microsoft.com...
>> >> >> >> Hello dl,
>> >> >> >>
>> >> >> >> where did i mention 2.0 ??
>> >> >> >>
>> >> >> >> ---------------------------------------
>> >> >> >> Dominick Baier - DevelopMentor
>> >> >> >> http://www.leastprivilege.com
>> >> >> >>
>> >> >> >> > Hi Dominick
>> >> >> >> > I am still on 1.1, and will not be using 2.0 in the near
>> >> >> >> > future
>> >> >> >> > though!
>> >> >> >> > "Dominick Baier [DevelopMentor]"
>> >> >> >> > <dbaier@pleasepleasenospamdevelop.com> wrote in message
>> >> >> >> > news:511931632551368453514427@news.microsoft.com...
>> >> >> >> >
>> >> >> >> >> Hello dl,
>> >> >> >> >>
>> >> >> >> >> there is a EventLog.CreateEventSource() method. But you need
>> >> >> >> >>
>> >> >> >> > administrative
>> >> >> >> >
>> >> >> >> >> privs to create an Event Source - so it will likely not work
>> >> >> >> >> from
>> >> >> >> >> asp.net directly.
>> >> >> >> >>
>> >> >> >> >> ---------------------------------------
>> >> >> >> >> Dominick Baier - DevelopMentor
>> >> >> >> >> http://www.leastprivilege.com
>> >> >> >> >>> Hi
>> >> >> >> >>> Has anyone successfully created a custom event log from
> asp.net
>> > /
>> >> >> >> >>> simply
>> >> >> >> >>> editing the Reg?! Can you share how, please?!
>> >> >> >> >>> TIA
>> >> >> >>
>> >> >> >>
>> >> >> >>
>> >> >> >
>> >> >> >
>> >> >>
>> >> >>
>> >> >
>> >> >
>> >>
>> >>
>> >
>> >
>>
>>
>
>



Relevant Pages

  • Re: Possible hack?
    ... Okay so this log was not deleted, it looks more like the Event log service ... full admin rights so you will find it very difficult to track him. ... > missing from the log files. ... >> However depending on the setup of your logging, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: 2 users getting locked out repeatedly
    ... Thanks Joe and all for the responses. ... >Go to the non-PDC and dump the security event log and ... >> lock her account. ... >> WAN link is at SP3. ...
    (microsoft.public.win2000.active_directory)
  • Re: Permissions on Event Log?
    ... It's not just an Admin Install but also some method to register the new ... can write to the event log and have often resorted to code that attempts ... I can create my own log file? ...
    (microsoft.public.dotnet.security)
  • RE: Solution: web application can not access event log
    ... Karlo, you have to all the posts to see the way around this if you are having ... The key is the "security" log permissions. ... If I impersonated an "admin", ... > assembly provided by MS) and use this to write to a custom event log. ...
    (microsoft.public.dotnet.security)
  • Re: Flexibility of Eventriggers in Win2003 - query on source + wil
    ... I created a very broad event trigger that looks only at entries of /EID "3" ... The event trigger runs a batch file that then calls a vbs script that uses ... WMI to interogate the event log directly pulling out the last few entries. ... Namely to tweak it so that it will check to see if it has sent the admin ...
    (microsoft.public.windows.server.general)