Error Writing to Event Log

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I am trying to write to the errorlog and I am getting the error

Cannot open log for source 'Application'. You may not have write access.

This is the code:

Dim Logevent As New EventLog("Application")
Logevent.Source = "Application"

Logevent.WriteEntry("Log In Error ", EventLogEntryType.Error)

The error is in the WriteEntry .

Thank you
 
More information to the above post.
I am using ASP.Net. Site is running in IIS 6.0 on Windows 2003 Server. code
is in a aspx page. app is running in a application pool with the idenity of
NETWORK SERVICE.
 
Hello Jerry,

try to use just
Dim Logevent As New EventLog()

JC> I am trying to write to the errorlog and I am getting the error
JC>
JC> Cannot open log for source 'Application'. You may not have write
JC> access.
JC>
JC> This is the code:
JC>
JC> Dim Logevent As New EventLog("Application")
JC> Logevent.Source = "Application"
JC> Logevent.WriteEntry("Log In Error ", EventLogEntryType.Error)
JC>
JC> The error is in the WriteEntry .
JC>
JC> Thank you
JC>
---
WBR,
Michael Nemtsev :: blog: http://spaces.msn.com/laflour

"At times one remains faithful to a cause only because its opponents do not
cease to be insipid." (c) Friedrich Nietzsche
 
Thanks for the reply.
I tried the line of code and I am still having the same problem.

Any help is appreciated
 
Hello Jerry,

Then u really need to grand/impersonate rights

See
http://www.c-sharpcorner.com/Code/2003/Sept/ErrorLoggingInASPNet.asp
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q329291
http://groups.google.com/groups/search?q=asp.net+EventLog+WriteEntry+write+access





JC> Thanks for the reply. I tried the line of code and I am still having
JC> the same problem.
JC>
JC> Any help is appreciated
JC>
JC> "Michael Nemtsev" wrote:
JC>---
WBR,
Michael Nemtsev :: blog: http://spaces.msn.com/laflour

"At times one remains faithful to a cause only because its opponents do not
cease to be insipid." (c) Friedrich Nietzsch
 
Hi Jerry,

Are you using Asp.net1.1 or 2.0? I have tried to copy your provided code
snippet in a Asp.net1.1 project Page_Load event(my test machine is Win2003
SP1 with VS.net2003 and VS2005 installed). The project's directory is using
Asp.net1.1 and running under default application pool with identity
NetworkService acount. However, the code runs well in the project both
under debugger and without debugger.

Can you provide the detailed information regarding this error? What is the
exception type of this error? You'd better provide the complete call stack
of this error. This will help us to identify if this error is a .Net code
access security exception or native Win32 eventlog access control
exception.

I will wait for your further information, thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Thank you for your replys.
I have tryed to set the permissions in the registry for this event log
"Application" and this soruce "Application" and I am still getting the error.
(Reboot also). I also created a new entry manually and still get the error.

Here is the error



[Win32Exception (0x80004005): Access is denied]

[InvalidOperationException: Cannot open log for source 'Application'. You
may not have write access.]
System.Diagnostics.EventLog.OpenForWrite(String currentMachineName) +719543
System.Diagnostics.EventLog.InternalWriteEvent(UInt32 eventID, UInt16
category, EventLogEntryType type, String[] strings, Byte[] rawData, String
currentMachineName) +206
System.Diagnostics.EventLog.WriteEntry(String message, EventLogEntryType
type, Int32 eventID, Int16 category, Byte[] rawData) +269
System.Diagnostics.EventLog.WriteEntry(String message, EventLogEntryType
type) +14
LoginV6.Page_Load(Object sender, EventArgs e) in
c:\inetpub\wwwroot\ContentDepot\LoginV6.aspx.vb:218
System.Web.UI.Control.OnLoad(EventArgs e) +99
System.Web.UI.Control.LoadRecursive() +47
System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1061


Thank you,
--
Jerry


"Jeffrey Tan[MSFT]" said:
Hi Jerry,

Are you using Asp.net1.1 or 2.0? I have tried to copy your provided code
snippet in a Asp.net1.1 project Page_Load event(my test machine is Win2003
SP1 with VS.net2003 and VS2005 installed). The project's directory is using
Asp.net1.1 and running under default application pool with identity
NetworkService acount. However, the code runs well in the project both
under debugger and without debugger.

Can you provide the detailed information regarding this error? What is the
exception type of this error? You'd better provide the complete call stack
of this error. This will help us to identify if this error is a .Net code
access security exception or native Win32 eventlog access control
exception.

I will wait for your further information, thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Hi Jerry,

Can you first confirm if you are using VS2005 or VS.net2003 in the project?

Below is the source code of System.Diagnostics.EventLog.OpenForWrite()
method:

private void OpenForWrite()
{
if (this.disposed)
{
throw new ObjectDisposedException(base.GetType().Name);
}
if ((this.sourceName == null) || this.sourceName.Equals(string.Empty))
{
throw new ArgumentException(SR.GetString("NeedSourceToOpen"));
}
SharedUtils.CheckEnvironment();
this.writeHandle =
UnsafeNativeMethods.RegisterEventSource(this.machineName, this.sourceName);
if (this.writeHandle == IntPtr.Zero)
{
Win32Exception exception1 = null;
if (Marshal.GetLastWin32Error() != 0)
{
exception1 = EventLog.CreateSafeWin32Exception();
}
throw new
InvalidOperationException(SR.GetString("CantOpenLogAccess"), exception1);
}
}

With the code, we can determine that your code fails in RegisterEventSource
win32 API calling.

In the document below, you will see that the RegisterEventSource needs
ELF_LOGFILE_WRITE permission:
"Event Logging Security"
http://windowssdk.msdn.microsoft.com/en-us/library/ms684080.aspx

Since your code runs well on my test environment, I suspect if the account
your exeuction thread runs under has some different feature. Can you tell
me what authentication mode you are using in you Asp.net project? Basic
authentication or Windows authentication? Do you use any impersonation in
your project?

In your LoginV6.Page_Load method, I recommend you print out the following
information on the page for troubleshooting purpose:

Imports System.Diagnostics
Imports System.Security.Principal
Public Class WebForm1
Inherits System.Web.UI.Page

Private Sub Page_Load(ByVal sender As System.Object, ByVal e As
System.EventArgs) Handles MyBase.Load
Dim id As IIdentity = WindowsIdentity.GetCurrent()
Me.Response.Write(id.Name + "<br>")
Me.Response.Write(id.IsAuthenticated.ToString() + "<br>")
Me.Response.Write(id.AuthenticationType + "<br>")
.....
End Sub
End Class

Please provide the output information to me. Thanks.

Once you determined the running account of the current thread, you may
modify the DACL setting of eventlog in registry with SDDL format.

On W2K3, the security of Application Event Log is controlled by CustomSD
registry value in key below:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application

CustomSD REG_SZ registry value is described by default in SDDL format as
below:
O:BAG:SYD:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A
;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)

In order for any authenticated user to be able to write to Application
Event Log, you will append:
(A;;0x3;;;AU)

where AU is referring "Authenticated Users".

Hope this helps.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Additionally, if you are curious, the article below describes the meaning
of the SDDL SID string:
http://windowssdk.msdn.microsoft.com/en-us/library/ms723312.aspx

While the 0x3 means Read|Write, it is documented in the "CustomSD" section
of the link below:
http://windowssdk.msdn.microsoft.com/en-us/library/ms684058.aspx

Thanks.

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Hi Jerry,

Have you reviewed my last 2 replies? Does it make sense to you? If you
still have any concern or need any help, please feel free to tell me,
thanks!

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top