Click here to Skip to main content
Rate this: bad
Please Sign up or sign in to vote.
See more: C#
I would like to create an event log which instead of located directly under "Application and Services Logs", located under another folder.
for example:
the current location of my event log is
"Application and Services Logs/My Event Log"
I wanted it to be
"Application and Services Logs/Event Log Folder/My Event Log"
Is there anyone who can suggest me the way to achieve this?
Posted 13-Feb-11 20:58pm
SAKryukov at 14-Feb-11 3:34am
Good question. My 5.
Rate this: bad
Please Sign up or sign in to vote.

Solution 2

Do you mean Windows System Log?
Yes, this is not so easy to understand. You need to install your own Event Source.
    using System.Diagnostics;
    internal class DefinitionSet {
        //define how much do you need:
        internal const int MaximumLogSizeKilobytes = 2048;
    } //class DefinitionSet

    public class EventLogInstallationHelper {
        public EventLogInstallationHelper(
            string applicationName, string eventLogName) {
                this.EventLogName = eventLogName;
                this.ApplicationName = applicationName;
        } //EventLogInstallationHelper

        public void Install() { //can throw exception!
            if ((!string.IsNullOrEmpty(ApplicationName)) && 
            EventLog log = new EventLog(EventLogName);
            log.MaximumKilobytes = DefinitionSet.MaximumLogSizeKilobytes; 
            log.ModifyOverflowPolicy(OverflowAction.OverwriteAsNeeded, 0);
        } //Install

        public void Uninstall() { //can throw exception!
            if (!string.IsNullOrEmpty(EventLogName)) {
                    EventLog deletingLog = new EventLog(EventLogName);
            } //if
            if (!string.IsNullOrEmpty(ApplicationName))
            result |= true;
            if (!string.IsNullOrEmpty(EventLogName))
            result |= true;
        } //Uninstall

        string ApplicationName, EventLogName;
    } //class EventLogInstallationHelper
The non-trivial part here is exception. You should deal with the case when you install Event Source if it is already done and uninstall when it is not installed.
Now, this is an example of the usage:
string Application = "Event Log Test";
string EventLogName = "CodeProject";
EventLogInstallationHelper helper =
    new EventLogInstallationHelper(
try {
} catch {
    System.Console.WriteLine("Event Log already installed");
} //exception

EventLog.WriteEntry(Application, "some log");
EventLog.WriteEntry(Application, "some warning", EventLogEntryType.Warning);
EventLog eventLog = new EventLog();
eventLog.Source = Application;
eventLog.WriteEntry("another log");
eventLog.WriteEntry("some error", EventLogEntryType.Error);
System.Console.WriteLine("See event log now, then press any key");
try {
} catch {
    System.Console.WriteLine("Event log already uninstalled");
} //exception
The idea here is that you can have EventLogName name, it represents all your logging applications in one separate folder. Another name, Application, will represent a name of one of your application as a source in each log's properties.
This code is well tested.
Nuri Ismail at 14-Feb-11 3:19am
Excellent helper. 5+
SAKryukov at 14-Feb-11 10:50am
Thank you,
Added usage sample, tested
Abhinav S at 14-Feb-11 3:22am
My 5. :)
Espen Harlinn at 14-Feb-11 10:27am
Good effort, my 5
SAKryukov at 14-Feb-11 10:50am
Thank you.
SAKryukov at 14-Feb-11 10:45am
Added fixed in the code of the helper, missing declarations to make code compile, added the sample of usage, the sample is tested: showing logs in separate folder as required.
Nishant Sivakumar at 14-Feb-11 11:55am
Voted 5. Good detailed response.
SAKryukov at 14-Feb-11 11:58am
Thank you, Nishant,
SAKryukov at 14-Feb-11 12:01pm
This stuff becoming pretty popular :-)
Thank you for accepting my answer.
Good luck, call again,
Manfred R. Bihy at 14-Feb-11 16:58pm
Very good! 5+
You've raised the bar once again. Keep it up man!
SAKryukov at 16-Feb-11 21:37pm
Oh, thanks a lot.
(OP still has a doubt it works.)
sirius007greatstar at 15-Feb-11 21:10pm
Hi SA,
I really appreciate your help.
However, it still doesn't give me the expected result.
The solution that you give me provide the "EventLogName" as one log file, and the "Application" as the source of each log entry.
Using your solution, this is the structure that I can see from Event Viewer:
> Event Viewer(Local)
> Applications and Services Logs
Hardware Events
> Microsoft
> Windows
Windows PowerShell
(Clicking on "CodeProject" will show you all entries with "Application" as the source)
What I really wanted is that the "Application" will appear as the log file, not as the source. I should look like this:
> Event Viewer(Local)
> Applications and Services Logs
> CodeProject
Hardware Events
> Microsoft
> Windows
Windows PowerShell
(Clicking on "CodeProject" will expand the tree and show you the event log file under it)
If you have any other method to achieve this, please share with me. I am desperately trying to achieve this without success until now.
Once again, I really appreciate your help. Thank you..
Best Regards,
SAKryukov at 16-Feb-11 20:57pm
Thank you for accepting my answer.
I don't understand what's wrong? I tested the solution.
Maybe the problem is about naming thing. I have created a code that generates two-level structure:
1) Folder which I call "Log Name";
2) A value for a column in the log, I called "Application".
Now, be logical and follow me. There is only 2-level structure in this technique, no more.
My idea was: 1) use "Log Name" for, say, your company or big product, it will form a folder. 2) Use "Application" for a particular application inside the product, it will go to Source column.
Now, you say: "I want...". First, stay within two-level structure. Secondly: realize I operate only with name. Naming does not change functionality. You want lesser-scale, more fine-grain? Folder is your application? Fine, give a "Log name" the name of your application. Within your application, create one or more sources. Give them some semantic names, they will go to the sources; no matter that I call it "Application". After all, rename my Application member into something else, and LogName member into "Application". You still have 2-level classification, no more no less. You show three levels in your request -- merge two of them into one.
If you don't like it -- blame Microsoft and create your alternative to their System Log (quite possible, by the way).
I already translated Microsoft documentation into code for you, you could do it by yourself but did not get enough patience (because you know enough I think). That is all that can be done in principle with this facility it terms of folder/member structure. And I think this is enough for all practical purposes. You need to know how not to abuse possibilities.
Thank you for understanding,
sirius007greatstar at 16-Feb-11 22:19pm
My knowledge is not good enough to create my own alternative, so I will just wait until Microsoft provides the capability to create more than 2-levels structure within their System Log. As for now, I guess there is no other way except to stay with the 2-levels structure.
Anyway, I really thank you for all your help. Marked yours as answer :)
Best Regards,
SAKryukov at 17-Feb-11 2:00am
You may have to wait too long time... I would use what's available. Believe me, it's good enough, and much better than most home-baked ways of logging.
munazza.farooq at 17-Mar-12 11:23am
Sir if u got any solution for this problem kindly share it i am facing the same kinda problem
SAKryukov at 18-Mar-12 14:54pm
Do you mean your problem? I don't know which one do you mean, could you please give me a link or ask a question?
Rate this: bad
Please Sign up or sign in to vote.

Solution 1

EventLog.CreateEventSource("Event Log Folder", "My Event Log"); 
EventLog.WriteMessage("Event Log Folder", "My message"); 
SAKryukov at 14-Feb-11 3:21am
Apparently you completed you typing faster then I did. My 5.
Abhinav S at 14-Feb-11 3:22am
Thanks. You posted a longer answer. :)
sirius007greatstar at 14-Feb-11 3:22am
Hi Abhinav,
Thanks for the quick reply.
I tried the method you mentioned, however, it still create the log directly under "Application and Services Logs"..
If you see in your Event viewer, you will see "Microsoft" folder under the "Application and Services Logs". I wanted my event log to be like that..
Best regards,
SAKryukov at 14-Feb-11 3:27am
Try to reboot the machine after creation of event log: there are situations when the system get messed up as a result of debug runs.
Also, I don't remember exactly, I'm not sure Abhinav used correct parameter.
EventLog.WriteMessage("My Event Log", "My message");
SAKryukov at 14-Feb-11 3:30am
Here is the API you need:
public static void WriteEntry(
string source,
string message
First parameter is event source, which is "My Event Log", not "Event Log Folder" in Anhinav's example.
SAKryukov at 14-Feb-11 3:33am
Please see all overloads of System.Diagnostics.EventLog.WriteEntry.
This is static approach. Non-static approach is creating an instance of EventLog and assign the event source permanently.
If you still did not sort it out, I'll write instructions on usage later.
sirius007greatstar at 14-Feb-11 3:44am
Hi SA,
Thanks for the reply.
I am not sure if I miss something in here, but i tried both methods and it's still giving me the same result = event log created directly under "Application and Services Logs, no folder or whatsoever"
The only difference is that the entries written stated different source in the "source" column.
Rebooting my pc is not solving the problem either.
Thank you..
Best Regards,
SAKryukov at 14-Feb-11 10:46am
See my updated answer: added usage sample, works as intended!
SAKryukov at 14-Feb-11 3:35am
Abhinav, I thing you made a bug in usage. See above.
Will you check up and fix it?
SAKryukov at 14-Feb-11 10:47am
Abhinav, I added usage sample to my Answer and tested it; it works.
You may want to test yours.
Abhinav S at 14-Feb-11 10:50am
Unfortunately I could not test this code. Perhaps will do so later.
If your code works, the OP can use your code snippet anyway. :)
SAKryukov at 14-Feb-11 11:58am
Sure. Thank you.
Nishant Sivakumar at 14-Feb-11 11:54am
Voted 5.
Abhinav S at 14-Feb-11 12:08pm
Thanks Nish.
This is one of few questions where I've seen answer comments go into 2 pages. ;)

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

  Print Answers RSS
0 Sergey Alexandrovich Kryukov 359
1 _Amy 230
2 OriginalGriff 220
3 Manfred R. Bihy 190
4 Andreas Gieriet 180
0 OriginalGriff 7,495
1 Sergey Alexandrovich Kryukov 6,402
2 Maciej Los 3,849
3 Peter Leow 3,568
4 CHill60 2,702

Advertise | Privacy | Mobile
Web01 | 2.8.140721.1 | Last Updated 14 Feb 2011
Copyright © CodeProject, 1999-2014
All Rights Reserved. Terms of Service
Layout: fixed | fluid

CodeProject, 503-250 Ferrand Drive Toronto Ontario, M3C 3G8 Canada +1 416-849-8900 x 100