9

As we know, we can use the class EventLog to write event logs, but I am confused about how to write category name in my event log. Thoug it provides the category parameter, for example, one of the type of WriteEntry is:

public void WriteEntry(
string message,
EventLogEntryType type,
int eventID,
short category

)
And it just shows number in my log. Why the type of category is short, not string? How to display the category name in the Event Viewer? Thanks! By the way, we will not create the custom CategoryMessageFile.

2 Answers 2

6

You can write an event log entry with a given category but you need to create an extra native dll with a String Resource table which is registered in the event log. This does complicate your deployment further. You currently have to do during installation

  1. To create new Event Log Sources you need to have admin rights every time you create a new source. It is therefore wise to collect all sources so you can install at once during the initial installation.
  2. Create a native dll which does contain a String Resource table for each category id you want to supply.
  3. Register the category dll in the registry to make Windows aware of it.

Now you can use the overload to write an event log message with a given category.

There is a very good Dr. Jobs Journal article describing exactly your problem.

3
  • Yes, I found this article, I know we can create an extra native dll, but it's not recommended in our development. So, I want to know if I can use the default system category names? May 6, 2012 at 9:10
  • What do you mean with not recommended? It is the only way. If you reuse category dlls from Windows you still need to register them for your event source. You can only use one category file for every event source. You are now designing event sources for each new category dll you want to use. I doubt that descriptive names will be there like Source1, Source2, Source3 only to reuse 3 differnt category files which do contain messages you have no control over. May 6, 2012 at 9:32
  • If you set category to '0', you will see the string 'none' in event viewer.
    – trindflo
    Sep 1, 2020 at 22:26
0

Don't use WriteEntry, you will get a Security Exception. Administrator rights aren't required after installation.

Use WriteEvent instead see: https://security.stackexchange.com/q/15857/396

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.