Writing to System Event Log

Introduction

This article provides details on how to write to the System Event log from a C# application.

Background

In many cases, it's best not only to detect and catch errors, but to log them as well. For example, some problems may occur only when your application is dealing with a particularly large load. Other problems may occur, with no obvious reasons as expected, only in certain remote situations. To diagnose these errors and build a larger picture of the application problems, you need to log errors automatically so they can be reviewed at a later time.

The .NET Framework provides a wide range of logging options. When certain errors occur, you can send emails, add a database record or write to a file. The following section throws light on how you can log error details to the System Event Log from your .NET application.

The Event Log

The Windows event log basically maintains three types of logs:

• Application: Used to track errors or notifications from any application
• Security: Used to track security related problems, used by the OS
• System: Used to track OS events

Each event record identifies the source (generally the application or service that created the record), the type of notification (error, information, warning) and the time it was logged. You can double-click on the log to view additional information such as a text description.

What to Log?

One of the potential problems with event logs is that they are automatically overwritten when the maximum set size is reached or after a certain number of days (typically seven days). This means application logs cannot be used to log critical information that need to be retained for a long period of time. Instead, they should be used to track information that is valuable only for a short period of time. For example, the event logs can be used to review errors and diagnose strange behavior immediately after it occurs, say within a couple of days or so.

Using the Code

The following sample code snippet shows how to write to the System Event Log. Here we try to read the contents of a text file. If the specified text file exists in the specified path, the contents are displayed. If the file is not found, control flow is passed to the catch() block and the corresponding error is logged to the system event log.

private void btnEventLogger_Click(object sender, EventArgs e)
{
    try
    {
        string FilePath, Line;
        FilePath = "C:\\MySampleFile.txt";
        StreamReader m_StreamReader;
        m_StreamReader = File.OpenText(FilePath);
        while ((Line = m_StreamReader.ReadLine()) != null)
        {
            MessageBox.Show(Line);        
        }
        m_StreamReader.Close();
    }
    catch (Exception ex)
    {
        EventLog m_EventLog = new EventLog("");
        m_EventLog.Source = "MySampleEventLog";
        m_EventLog.WriteEntry("Reading text file failed " + ex.Message,
            EventLogEntryType.FailureAudit);

        MessageBox.Show(
           "Successfully wrote the following to the System Event Log : \n" 
			+ ex.Message); 
    }
}

Sample Event Log Images

The Event Viewer can be accessed from Administrative Tools > Event Viewer.

On double clicking an item from the list, the details of that item would be opened up. The error message can be viewed in the Description area.

Points of Interest

The System.Diagnostics namespace provides classes that allow you to interact with system processes, event logs, and performance counters. Therefore, include this namespace to use the EventLog class.

Event logging uses disk space and normally takes processor time away from applications. So do not store unimportant information or large quantities of data in the event log. Generally, an event log should be used to log unexpected conditions or errors and not user actions or performance tracking information.

History

• 3^rd September, 2008: Initial post