.NET 1.1 created event log has only "Not available" properties

We are using VB.NET 2003 Diagnostics.EventLog class on Windows 2000 to create
our own custom event log. When using Computer Management and doing
properties on the event log it only displays "Not available" for the Size,
Created, Modified, and Accessed attributes. The event log is working just
not the display of the attributes mentioned above.

Does anybody know how to resolve this?

--
Thanks,

Tim

stcheng
Wed Apr 12 22:31:36 CDT 2006

Hi Tim,

Thank you for posting.

From your description, I understanding you're using the EventLog class to
write entries into custom eventlog in .net 1.1 application. However, after
wrting the log correctly, you found that you can not view the custom log's
properties(size, modified...) in computer management console, correct?

Based on my local test, the custom log created or write through the
EventLog class should populated the specific properties correctly. So I
think it is likely a machine specific issue. Have you tried the application
or a very simple evetlog writing code snippet as below on some other
machines:

=================
private void button1_Click(object sender, System.EventArgs e)
{
if(!EventLog.SourceExists("MySource"))
{
EventLog.CreateEventSource("MySource", "MyNewLog1");
Console.WriteLine("CreatingEventSource");
}

// Create an EventLog instance and assign its source.
EventLog myLog = new EventLog();
myLog.Source = "MySource";

// Write an informational entry to the event log.
myLog.WriteEntry("Writing to event log.");

}
============

Or does it work if first create the customlog externally and then use
eventlog class to write into it?

Please feel free to post here if there is anything I missed.

Regards,

Steven Cheng
Microsoft Online Community Support


==================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

==================================================


This posting is provided "AS IS" with no warranties, and confers no rights.



Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

fullhouse
Thu Apr 13 06:32:02 CDT 2006

I tried the example on two more machines today with the same result. I have
tried it on three different Windows 2000 domains with varying security
settings (minimal to very secure) and all three domains display "Not
Available" for the attributes within Computer Management.

--
Thanks,

Tim


"Steven Cheng[MSFT]" wrote:

> Hi Tim,
>
> Thank you for posting.
>
> From your description, I understanding you're using the EventLog class to
> write entries into custom eventlog in .net 1.1 application. However, after
> wrting the log correctly, you found that you can not view the custom log's
> properties(size, modified...) in computer management console, correct?
>
> Based on my local test, the custom log created or write through the
> EventLog class should populated the specific properties correctly. So I
> think it is likely a machine specific issue. Have you tried the application
> or a very simple evetlog writing code snippet as below on some other
> machines:
>
> =================
> private void button1_Click(object sender, System.EventArgs e)
> {
> if(!EventLog.SourceExists("MySource"))
> {
> EventLog.CreateEventSource("MySource", "MyNewLog1");
> Console.WriteLine("CreatingEventSource");
> }
>
> // Create an EventLog instance and assign its source.
> EventLog myLog = new EventLog();
> myLog.Source = "MySource";
>
> // Write an informational entry to the event log.
> myLog.WriteEntry("Writing to event log.");
>
> }
> ============
>
> Or does it work if first create the customlog externally and then use
> eventlog class to write into it?
>
> Please feel free to post here if there is anything I missed.
>
> Regards,
>
> Steven Cheng
> Microsoft Online Community Support
>
>
> ==================================================
>
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
>
> ==================================================
>
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
>
> Get Secure! www.microsoft.com/security
> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
>
>

fullhouse
Thu Apr 13 07:53:02 CDT 2006

I found part of the problem. Looking at the EventLog registry entries, there
are several missing registry values for the .NET created event logs. By
manually adding the HKLM\SYSTEM\CurrentControlSet\Services\EventLog\<event
log name>\File registry value with the path to the event log file the
attibutes are now populated.
--
Thanks,

Tim


"Tim" wrote:

> I tried the example on two more machines today with the same result. I have
> tried it on three different Windows 2000 domains with varying security
> settings (minimal to very secure) and all three domains display "Not
> Available" for the attributes within Computer Management.
>
> --
> Thanks,
>
> Tim
>
>
> "Steven Cheng[MSFT]" wrote:
>
> > Hi Tim,
> >
> > Thank you for posting.
> >
> > From your description, I understanding you're using the EventLog class to
> > write entries into custom eventlog in .net 1.1 application. However, after
> > wrting the log correctly, you found that you can not view the custom log's
> > properties(size, modified...) in computer management console, correct?
> >
> > Based on my local test, the custom log created or write through the
> > EventLog class should populated the specific properties correctly. So I
> > think it is likely a machine specific issue. Have you tried the application
> > or a very simple evetlog writing code snippet as below on some other
> > machines:
> >
> > =================
> > private void button1_Click(object sender, System.EventArgs e)
> > {
> > if(!EventLog.SourceExists("MySource"))
> > {
> > EventLog.CreateEventSource("MySource", "MyNewLog1");
> > Console.WriteLine("CreatingEventSource");
> > }
> >
> > // Create an EventLog instance and assign its source.
> > EventLog myLog = new EventLog();
> > myLog.Source = "MySource";
> >
> > // Write an informational entry to the event log.
> > myLog.WriteEntry("Writing to event log.");
> >
> > }
> > ============
> >
> > Or does it work if first create the customlog externally and then use
> > eventlog class to write into it?
> >
> > Please feel free to post here if there is anything I missed.
> >
> > Regards,
> >
> > Steven Cheng
> > Microsoft Online Community Support
> >
> >
> > ==================================================
> >
> > When responding to posts, please "Reply to Group" via your newsreader so
> > that others may learn and benefit from your issue.
> >
> > ==================================================
> >
> >
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> >
> >
> >
> > Get Secure! www.microsoft.com/security
> > (This posting is provided "AS IS", with no warranties, and confers no
> > rights.)
> >
> >

stcheng
Fri Apr 14 05:26:52 CDT 2006

Thanks for the followup Tim,

Seems the eventlog's data file is not correctly created, this still seems a
strange problem. Are you running the code under a admin or powerful user
account?

Regards,

Steven Cheng
Microsoft Online Community Support


==================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

==================================================


This posting is provided "AS IS" with no warranties, and confers no rights.

fullhouse
Fri Apr 14 06:40:02 CDT 2006

Yes, the account is a member of the local administrator's group.

--
Thanks,

Tim


"Steven Cheng[MSFT]" wrote:

> Thanks for the followup Tim,
>
> Seems the eventlog's data file is not correctly created, this still seems a
> strange problem. Are you running the code under a admin or powerful user
> account?
>
> Regards,
>
> Steven Cheng
> Microsoft Online Community Support
>
>
> ==================================================
>
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
>
> ==================================================
>
>
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
>

stcheng
Mon Apr 17 02:48:48 CDT 2006

This seems strange, my local test through the LOCAL admin account can
create the custom event log correctly (through the .NET EventLog class).
Maybe something else which cause the problem. Have you tried using Filemon
tool to trace the NTFS file access to see whether there is any file access
failure when you use .NET code to create eventsource on that machine?

Regards,

Steven Cheng
Microsoft Online Community Support


==================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

==================================================


This posting is provided "AS IS" with no warranties, and confers no rights.