5

When using C# to write events to Windows Events, the 'Keywords' value is always 'Classic'. I've been digging around online and can't find anything.
Is this possible? If so, I'd appreciate an example.

Cheers

3
  • What do you mean by: the 'Keywords' value is always 'Classic'?
    – Omar
    Nov 13, 2012 at 17:06
  • Can you provide a code sample illustrating what you're seeing?
    – Chris
    Nov 13, 2012 at 17:11
  • Sorry, the 'Keywords' value can be one of the following standard event keywords: The standard event keywords are defined in StandardEventKeywords Enumeration: AuditFailure AuditSuccess Classic Correlation Hint SQL WDI Context WDI Diag I'm using C# EventLog Write to write events and there is no 'keyword' parameter...wondering if this can be done? Nov 13, 2012 at 17:18

2 Answers 2

1

So as I get you correct you mean StandardEventKeywords enumeration. And you want to write in windows log. Right?

In this case you need to use EventProvider.WriteEvent method. In description of EventProvider.WriteEvent you can find example.

If you want to add other "Keywords" than "Classic" - I guess you need to add appropriate enum value in eventPayload array. Try it and let me know about result.

1
  • Setting the EventLogEntryType to 'SuccessfulAudit' or 'FailureAudit' will set the 'Keywords' value to 'Classic/SuccessfulAudit' or 'Classic/FailureAudit'. The 'Level' value will always be 'Information'. Thanks for the help guys. Nov 14, 2012 at 14:00
1

To write an eventlog entry tagged with custom keywords, you have to create an event manifest file along with a resource dll. You then have to register this manifest, the manifest has to reference the resource file. There are two ways to achieve this:

  1. manually by using ecmangen
  2. use the eventregister program provided by the Microsoft EventSource Library nuget package

The manual route is more complicated but gives you a cleaner result. With the help of the article "Writing to the event log in .NET - the right way" by Daniel Gordon you'll be able to properly log your events.

To sum up the procedure: First, create a manifest using ecmangen. Read the help provided by the tool, it'll walk you through the creation process. Once you have authored your manifest with your custom keywords section, compile it using mc and then generate the resource file as described in the article. To make use of your manifest, you have to install it as an eventlog source. Do that using the wevtutil program. The program will fail if you don't alter the manifest to point to the resource dll that has been created earlier. An odd thing about this process is that the wevtutil program keeps on reporting an error unless you have copied the resource file to a location which does not contain spaces in its path.

After you have successfully registered the event source, you can log events to it by using the System.Diagnostics.Eventing namespace. Create an EventProvider like so:

var provider = new EventProvider( new Guid( "VALUE-OF-GUID-ATTRIBUTE-OF-PROVIDER-ELEMENT-IN-MANIFEST" ) );

Specify an Eventdescriptor corresponding to your manifest. Take a look at the cs file that was generated when you compiled the manifest.

EventDescriptor customDescriptor;
unchecked
{
    customDescriptor = new EventDescriptor( 0x2, 0x0, 0x10, 0x4, 0xa, 0x1, ( long ) 0x8000000000000001 );
}

At last, pass the Eventdescriptor to your provider to log a message:

var customEventResult = provider.WriteEvent( ref customDescriptor, (long)1, 1, "Custom Event" );

This will create an eventlog entry with a keyword set to whatever is defined in your manifest as the keyword with the mask 0x1.

If you want to save yourself from all this manual compiling and whatnot, you can just install the Microsoft EventSource Library with nuget. Unfortunately this route has two shortcomings, one is that you can't define custom channels, the second is that custom keywords are "dirty", see my lengthy question here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.