.NET 1.1+

Logging Messages in Event Logs (2)

Microsoft Windows provides a built-in event logging system where informational messages, warnings, errors and audit details can be stored and viewed with the Event Viewer utility. This system is ideal for logging messages generated by a .NET application.

The Event Viewer

To view the centralised set of event logs and the messages contained within, you use the Event Viewer application. This tool can be found in the Administrative Tools section of the Control Panel.

The above diagram shows a sample of the Event Viewer from Windows XP. In later operating systems, such as Vista, the layout of the window is quite different although the basic elements are the same. To the left is a hierarchical list of all of the event logs registered in the operating system. In the figure above you can see the three standard logs and an additional application-specific log for Internet Explorer.

The right side of the window shows the individual events that have been created in the currently selected log. The events are displayed in a grid with columns that identify information such as the type of message logged, the date and time at which the event was created and the event source. The event source is a named source that usually represents a single application or module within a system. To see the full text of a logged message, you can double-click it.

The Event Logger provides many options for viewing, filtering, saving and clearing logs. However, these are beyond the scope of this article.

Logging Events

In the remainder of this article we will demonstrate some of the methods available for logging events in an event log. If you wish to follow the examples, create a new console application and use the Main method to try the sample code. As the classes used in the examples are within the System.Diagnostics namespace, you should add the following line at the top of the class containing the Main method:

using System.Diagnostics;

Registering an Event Source

As we have seen, when an event is logged it is associated with an event source. The source appears in the list of events in a log, making it easier to filter and sort events based upon their source. For a source to be used correctly, it must first be registered with the operating system and associated with a specific event log. This is achieved using the CreateEventSource method of the EventLog class. This static method requires two parameters that specify the names of the event source and the associated log respectively.

We can create a sample event source named "My Sample Event Source" and link it to the Application log by adding the following commands to the Main method:

string eventSource = "My Sample Event Source";
EventLog.CreateEventSource(eventSource, "Application");

If you execute the program in its current form, the event source will be created. However, if you run the program a second time you will receive an ArgumentException. This exception occurs because you may not create the same event source twice. Luckily, you can check for the existence of an event log before trying to create it to avoid this error. To do so, you use the SourceExists method, passing the name of the event source to check for.

Change the contents of the Main method to that shown below to avoid the exception:

string eventSource = "My Sample Event Source";

if (!EventLog.SourceExists(eventSource))
    EventLog.CreateEventSource(eventSource, "Application");