Click here to Skip to main content
15,886,873 members
Please Sign up or sign in to vote.
2.60/5 (5 votes)
See more:
Hi,

I would like to create an event log which instead of located directly under "Application and Services Logs", located under another folder.

for example:
the current location of my event log is
"Application and Services Logs/My Event Log"

I wanted it to be
"Application and Services Logs/Event Log Folder/My Event Log"

Is there anyone who can suggest me the way to achieve this?
Posted
Updated 4-Sep-18 3:46am
Comments
Sergey Alexandrovich Kryukov 14-Feb-11 3:34am    
Good question. My 5.
--SA
Delphiwizard 18-Nov-20 8:31am    
I know this is 9 years old but i am looking for the same, but in Delphi not in C#, i am looking for a similar solution in Delphi code, if anyone has accomplished this, please let me know.

Try
EventLog.CreateEventSource("Event Log Folder", "My Event Log"); 
EventLog.WriteMessage("Event Log Folder", "My message"); 
 
Share this answer
 
Comments
Sergey Alexandrovich Kryukov 14-Feb-11 3:21am    
Apparently you completed you typing faster then I did. My 5.
--SA
Abhinav S 14-Feb-11 3:22am    
Thanks. You posted a longer answer. :)
sirius007greatstar 14-Feb-11 3:22am    
Hi Abhinav,

Thanks for the quick reply.
I tried the method you mentioned, however, it still create the log directly under "Application and Services Logs"..

If you see in your Event viewer, you will see "Microsoft" folder under the "Application and Services Logs". I wanted my event log to be like that..

Thanks..
Best regards,
Paulus
Sergey Alexandrovich Kryukov 14-Feb-11 3:27am    
Try to reboot the machine after creation of event log: there are situations when the system get messed up as a result of debug runs.

Also, I don't remember exactly, I'm not sure Abhinav used correct parameter.
Try:
EventLog.WriteMessage("My Event Log", "My message");
Sergey Alexandrovich Kryukov 14-Feb-11 3:30am    
Here is the API you need:

public static void WriteEntry(
string source,
string message
)
First parameter is event source, which is "My Event Log", not "Event Log Folder" in Anhinav's example.

--SA
Do you mean Windows System Log?
Yes, this is not so easy to understand. You need to install your own Event Source.

C#
using System.Diagnostics;

internal class DefinitionSet {
    //define how much do you need:
    internal const int MaximumLogSizeKilobytes = 2048;
} //class DefinitionSet

public class EventLogInstallationHelper {

    public EventLogInstallationHelper(
        string applicationName, string eventLogName) {
            this.EventLogName = eventLogName;
            this.ApplicationName = applicationName;
    } //EventLogInstallationHelper

    public void Install() { //can throw exception!
        if ((!string.IsNullOrEmpty(ApplicationName)) &&
            (!string.IsNullOrEmpty(EventLogName)))
                  EventLog.CreateEventSource(
                      ApplicationName,
                      EventLogName);
        EventLog log = new EventLog(EventLogName);
        log.MaximumKilobytes = DefinitionSet.MaximumLogSizeKilobytes;
        log.ModifyOverflowPolicy(OverflowAction.OverwriteAsNeeded, 0);
    } //Install

    public void Uninstall() { //can throw exception!
        if (!string.IsNullOrEmpty(EventLogName)) {
                EventLog deletingLog = new EventLog(EventLogName);
                deletingLog.Clear();
        } //if
        if (!string.IsNullOrEmpty(ApplicationName))
                EventLog.DeleteEventSource(ApplicationName);
        result |= true;
        if (!string.IsNullOrEmpty(EventLogName))
                EventLog.Delete(EventLogName);
        result |= true;
    } //Uninstall

    string ApplicationName, EventLogName;

} //class EventLogInstallationHelper


The non-trivial part here is exception. You should deal with the case when you install Event Source if it is already done and uninstall when it is not installed.

Now, this is an example of the usage:

C#
string Application = "Event Log Test";
string EventLogName = "CodeProject";
EventLogInstallationHelper helper =
    new EventLogInstallationHelper(
        Application,
        EventLogName);

try {
    helper.Install();
} catch {
    System.Console.WriteLine("Event Log already installed");
} //exception

EventLog.WriteEntry(Application, "some log");
EventLog.WriteEntry(Application, "some warning", EventLogEntryType.Warning);
EventLog eventLog = new EventLog();
eventLog.Source = Application;
eventLog.WriteEntry("another log");
eventLog.WriteEntry("some error", EventLogEntryType.Error);

System.Console.WriteLine("See event log now, then press any key");
System.Console.ReadKey(true);

try {
    helper.Uninstall();
} catch {
    System.Console.WriteLine("Event log already uninstalled");
} //exception


The idea here is that you can have EventLogName name, it represents all your logging applications in one separate folder. Another name, Application, will represent a name of one of your application as a source in each log's properties.

This code is well tested.

—SA
 
Share this answer
 
v5
Comments
Nuri Ismail 14-Feb-11 3:19am    
Excellent helper. 5+
Sergey Alexandrovich Kryukov 14-Feb-11 10:50am    
Thank you,
Added usage sample, tested
--SA
Abhinav S 14-Feb-11 3:22am    
My 5. :)
Espen Harlinn 14-Feb-11 10:27am    
Good effort, my 5
Sergey Alexandrovich Kryukov 14-Feb-11 10:50am    
Thank you.
--SA
I was struggling to get the subfolder piece working as well, as I would like to have a structure like:
- Application and Services Logs
-- Company Name
--- Application 1
---- ApplicationLog
--- Application 2
---- SecurityLog
---- OperationalLog

I could not find any way to do this directly using C, however after doing some trial and error with registry keys and the documentation provided at https://docs.microsoft.com/en-us/windows/desktop/eventlog/eventlog-key I finally got it to work.
It seems that you need to create keys at HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels, where the primary registry key name is key to the 'folder' structure. a '-' is seen as a deeper structure. So for example: CompanyName\Application\Log, should be a key named CompanyName-Application-Log.

Below is an example script to do this using PowerShell:

# Create the eventlog (in a subfolder structure)
# Params()
$PrimaryEventKey = 'Company'
$ApplicationName = 'Application'
$LogName = 'NewLog'

# Vars()
$primarylocation = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels'
$LogName = $PrimaryEventKey + '-' + $ApplicationName + '-' + $LogName
$EventRoot = (Join-Path $primarylocation $LogName)

if (!(Test-Path $EventRoot)) {
    New-Item -Path $EventRoot
    New-ItemProperty -Path $EventRoot -Name Enabled -PropertyType DWord -Value 1
    New-ItemProperty -Path $EventRoot -Name Type -PropertyType DWord -Value 1
    New-ItemProperty -Path $EventRoot -Name Isolation -PropertyType DWord -Value 0
    New-ItemProperty -Path $EventRoot -Name RestrictGuestAccess -PropertyType String -Value 1
    New-ItemProperty -Path $EventRoot -Name OwningPublisher -PropertyType String -Value "{$($GUID)}"

    # See https://docs.microsoft.com/en-us/windows/desktop/eventlog/eventlog-key for documentation on the ChannelAccess or or RestrictGuestAccess (see: RestrictGuestAccess / Isolation)
}
else {
    Write-Warning 'Event Log (Key) Already exists in registry'
}

# Write into the event log (Example)
$eventType = ([System.Diagnostics.EventLogEntryType]::Information)
$evt = New-Object System.Diagnostics.EventLog($LogName)
$evt.Source = "SomeSource"
$evt.WriteEntry("random message", $eventType, 60001)
 
Share this answer
 
v4
Comments
rajeshaz09 10-May-22 21:29pm    
@DdebBraver, could you update PowerShell script with "$secondarylocation" path? looks like it is missing.
DdenBraver 11-May-22 4:43am    
Hm, seems I accedentally copied this compare line from my original test back then.
Those 2 lines should not be required to get it to work. I removed them above from the solution :-)

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900