StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POlogging to custom event log (C# app, but using win32 API)
text
Body
copied!<p>Due to a limitation in the .NET EventLog class, I have some code using PInvoke that logs to the Application log. The code works without a problem.</p> <p>But now, I'd like to log to a custom event log. So, I tried changing the 2nd parameter of the RegisterEventSource to "companyX" (my custom log). It <i>correctly wrote to "companyX" </i>(instead of the Application log), but it <i>also set the Source field</i> (of the individual log entry) to "companyX," which is not what I want.</p> <p>So how do I modify the code to:</p> <ul> <li>Use the new, custom event log ("companyX"), but also</li> <li>Use the correct Source value ("MyApp")</li> </ul> <p>Currently, it either correctly writes to the Application log (with the correct Source value of "MyApp"), or it writes to the custom ("companyX") event log, and uses the <b>incorrect</b> Source value (rather than "MyApp", it sets the Source value to "companyX", the name of the custom log).</p> <p>EDIT: Note that the "companyX" log has already been created (in WIX installer code).</p> <p>Here's my code:</p> <pre><code>private void WriteEntryToLog(string msg, LogEventType entryType) { // ApplicationName = "MyApp" // The code as-is is writing to the Application log. Changing the 2nd param of // the function below to "companyX" allows me to write to my "companyX" event log, // but also changes the Source value of each entry append to that log to "companyX" rather than "MyApp" IntPtr eventSrcHandle = NativeMethods.RegisterEventSource(null, Resources.ApplicationName); try { uint tokenInfoSize = 0; IntPtr userTokenPtr = WindowsIdentity.GetCurrent().Token; const UInt16 typeError = 1, typeWarning = 2, typeInformation = 4; //using this first call, get the length required to hold the token information in the tokenInfoSize parameter bool bresult = NativeMethods.GetTokenInformation(userTokenPtr, NativeMethods.TOKEN_INFORMATION_CLASS.TokenUser, IntPtr.Zero, tokenInfoSize, out tokenInfoSize); if (bresult) throw new Win32Exception(Marshal.GetLastWin32Error()); IntPtr userTokenInfo = Marshal.AllocHGlobal((int)tokenInfoSize); try { //get the user token now with the pointer allocated to the right size bresult = NativeMethods.GetTokenInformation(userTokenPtr, NativeMethods.TOKEN_INFORMATION_CLASS.TokenUser, userTokenInfo, tokenInfoSize, out tokenInfoSize); if (!bresult) throw new Win32Exception(Marshal.GetLastWin32Error()); UInt16 type = typeError; switch (entryType) { case LogEventType.Error: type = typeError; break; case LogEventType.Warning: type = typeWarning; break; case LogEventType.Information: type = typeInformation; break; default: type = typeInformation; break; } NativeMethods.TOKEN_USER tokUser = (NativeMethods.TOKEN_USER)Marshal.PtrToStructure(userTokenInfo, typeof(NativeMethods.TOKEN_USER)); string[] message = new string[1]; message[0] = msg; bresult = NativeMethods.ReportEvent(eventSrcHandle, type, 0, 0, tokUser.User.Sid, 1, 0, message, new byte()); if (!bresult) throw new Win32Exception(Marshal.GetLastWin32Error()); } finally { Marshal.FreeHGlobal(userTokenInfo); } } finally { NativeMethods.DeregisterEventSource(eventSrcHandle); } </code></pre> <p>}</p> <p>Oh, and this is not a repeat of the question here: <a href="https://stackoverflow.com/questions/499645/custom-value-for-the-event-log-source-property-for-asp-net-errors"><a href="https://stackoverflow.com/questions/499645/custom-value-for-the-event-log-source-property-for-asp-net-errors">Custom value for the Event Log source property for ASP.NET errors</a></a> since I have to use PInvoke for this. =)</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload