EventLog.SourceExists

https://stackoverflow.com/questions/9564420/the-source-was-not-found-but-some-or-all-event-logs-could-not-be-searched

EventLog.SourceExists enumerates through the subkeys of HKLM\SYSTEM\CurrentControlSet\services\eventlog to see if it contains a subkey with the specified name.

If the user account under which the code is running does not have read access to a subkey that it attempts to access (in your case, the Security subkey) before finding the target source, you will see an exception like the one you have described.

The usual approach for handling such issues is to register event log sources at installation time (under an administrator account), then assume that they exist at runtime, allowing any resulting exception to be treated as unexpected if a target event log source does not actually exist at runtime.

  private void LogUtil_Error(object sender, Log4NetError e)
{
using (EventLog eventLog = new EventLog("Lisa"))
{
eventLog.Source = "LISA.BackOffice";
var message = $"{AppDomain.CurrentDomain.BaseDirectory}{Environment.NewLine}{e}";
eventLog.WriteEntry(message, EventLogEntryType.Error);
}
Environment.Exit();
}

The source was not found, but some or all event logs could not be searched.

To create the source, you need permission to read all event logs to make sure that the new source name is unique.  Inaccessible logs: Security.

System.Security.SecurityException when writing to Event Log

答案1

To give Network Service read permission on the EventLog/Security key (as suggested by Firenzi and royrules22) follow instructions from http://geekswithblogs.net/timh/archive/2005/10/05/56029.aspx

  1. Open the Registry Editor:
    1. Select Start then Run
    2. Enter regedt32 or regedit
  2. Navigate/expand to the following key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Security

  3. Right click on this entry and select Permissions

  4. Add the Network Service user

  5. Give it Read permission

UPDATE: The steps above are ok on developer machines, where you do not use deployment process to install application.
However if you deploy your application to other machine(s), consider to register event log sources during installation as suggested in SailAvid's and Nicole Calinoiu's answers.

I am using PowerShell function (calling in Octopus Deploy.ps1)

function Create-EventSources() {
$eventSources = @("MySource1","MySource2" )
foreach ($source in $eventSources) {
if ([System.Diagnostics.EventLog]::SourceExists($source) -eq $false) {
[System.Diagnostics.EventLog]::CreateEventSource($source, "Application")
}
}
}

答案2

The problem is that the EventLog.SourceExists tries to access the EventLog\Security key, access which is only permitted for an administrator.

A common example for a C# Program logging into EventLog is:

string sSource;
string sLog;
string sEvent; sSource = "dotNET Sample App";
sLog = "Application";
sEvent = "Sample Event"; if (!EventLog.SourceExists(sSource))
EventLog.CreateEventSource(sSource, sLog); EventLog.WriteEntry(sSource, sEvent);
EventLog.WriteEntry(sSource, sEvent, EventLogEntryType.Warning, 234);

However, the following lines fail if the program hasn't administrator permissions and the key is not found under EventLog\Application as EventLog.SourceExists will then try to access EventLog\Security.

if (!EventLog.SourceExists(sSource))
EventLog.CreateEventSource(sSource, sLog);

Therefore the recommended way is to create an install script, which creates the corresponding key, namely:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\dotNET Sample App

One can then remove those two lines.

You can also create a .reg file to create the registry key. Simply save the following text into a file create.reg:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\dotNET Sample App]
 

在application pool的高级设置里面

设置identity。一个有4个设置级别,local service,local system,network service,application pool identity

经过测试,发现只有local system有权限写event log

The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security.的更多相关文章

  1. System.Security.SecurityException The source was not found, but some or all event logs could not be searched.Inaccessible logs Security.

    An exception occurred during the Install phase. System.Security.SecurityException The source was not ...

  2. 【.net】The source was not found, but some or all event logs could not be searched

    1.案发现场: 注册服务的时候 2.解决方案: 用管理员身份运行CMD,再注册服务: I had to run Command Prompt with Administrator Rights.

  3. windows服务部署与卸载

    同事问到windows service的东东,现在整理一下,用c#如何创建一个windows service,以及如何调试.部署.卸载. 一.创建windows service 1. 打开VS2008 ...

  4. 使用InstallUtil安装及卸载Windows服务的具体操作 Visual Studio 2012版本

    关于Visual Studio 2012中使用InstallUtil对Windows服务进行安装与卸载的文章,在MSDN中的http://msdn.microsoft.com/en-us/librar ...

  5. 【翻译】Flume 1.8.0 User Guide(用户指南) source

    翻译自官网flume1.8用户指南,原文地址:Flume 1.8.0 User Guide 篇幅限制,分为以下5篇: [翻译]Flume 1.8.0 User Guide(用户指南) [翻译]Flum ...

  6. Flume自定义Source、Sink和Interceptor(简单功能实现)

    1.Event event是flume传输的最小对象,从source获取数据后会先封装成event,然后将event发送到channel,sink从channel拿event消费. event由头he ...

  7. 60款开源云应用【Part 3】(60 Open Source Apps You Can Use in the Cloud)

    60款开源云应用[Part 3](60 Open Source Apps You Can Use in the Cloud) 本篇翻译自http://www.datamation.com/open-s ...

  8. 一次flume exec source采集日志到kafka因为单条日志数据非常大同步失败的踩坑带来的思考

    本次遇到的问题描述,日志采集同步时,当单条日志(日志文件中一行日志)超过2M大小,数据无法采集同步到kafka,分析后,共踩到如下几个坑.1.flume采集时,通过shell+EXEC(tail -F ...

  9. The Open Source Business Model is Under Siege

    https://www.influxdata.com/blog/the-open-source-database-business-model-is-under-siege/ A few weeks ...

随机推荐

  1. CAD控件:网上打开dwg文件时,对dwg文件路径加密的功能

    梦想CAD控件2015.03.12最新更新  1. 增加控件状态栏文字,自定义功能,        C++接口为 :   CStatusBarInformationReactor::CreatePro ...

  2. 06Microsoft SQL Server 完整性约束

    Microsoft SQL Server 完整性约束 标识 IDENTITY自动编号 CREATE TABLE table_name( id ,), NAME ) not null, sex ) de ...

  3. 【LeetCode】9、Palindrome Number(回文数)

    题目等级:Easy 题目描述: Determine whether an integer is a palindrome. An integer is a palindrome when it rea ...

  4. 【Js 文件】 相关

    防止浏览器缓存 <script src="/js/common.js?t=<%=DateTime.Now.ToFileTime().ToString()%>>&quo ...

  5. 使用TransactionTemplate

    通过TransactionCallback接口中的方法后(这里用来做业务),将返回值传递到TransactionTemplate的execute()中.通过调用TransactionStatus 的s ...

  6. 最大子段和(洛谷P1115,动态规划递推)

    洛谷题目链接 题目赋值出来格式有问题,所以我就只放题目链接了 下面为ac代码 #include<bits/stdc++.h> #define ll long long using name ...

  7. 07Html、CSS

    07Html.CSS-2018/07/17 1.HTML是用来描述网页的一种标记语言,是一套标记标签.HTML用使用标记标签来描述网页.超文本 标记语言. 2.格式 <html> < ...

  8. [Luogu] P3225 [HNOI2012]矿场搭建

    题目描述 煤矿工地可以看成是由隧道连接挖煤点组成的无向图.为安全起见,希望在工地发生事故时所有挖煤点的工人都能有一条出路逃到救援出口处.于是矿主决定在某些挖煤点设立救援出口,使得无论哪一个挖煤点坍塌之 ...

  9. 日常操作之如何打开windows注册表

    1.打开注册表:第一步按“win+R”或者点击开始菜单,找到运行,在运行输入框里面输入“regedit”.

  10. 55.fielddata内存控制以及circuit breaker断路器

    课程大纲 fielddata加载 fielddata内存限制 监控fielddata内存使用 circuit breaker 一.fielddata加载 fielddata加载到内存的过程是lazy加 ...