.net – Security Issues Writing to Event Log with My.Application.Log.WriteException

loggingvb.net

I'm handling the Application.UnhandledException event in a WinForms app and need to log exceptions caught there. My app.config is set up to log exceptions to a FileLog and an EventLog.

The problem is that when running as a non-admin user, the EventLog cannot be written to because of a SecurityException – I get the message "The source was not found, but some or all event logs could not be searched."

I understand why – the user does not have permission to create the EventLog source, but the question is how should this source be created? As I see it, I could either:

1) Create the EventLog source with my installer, as this is running as admin. How to do this?

2) Create from within my app, by somehow elevating permissions? But this would give the UAC prompt on Vista.

What's the best practice for creating a Windows Application EventLog source on a client machine?

thanks

Best Answer

The most common way to do this is your Option 1.

How you do it depends on your installer package, but you need to:

Ensure your installer runs with elevated permission.
Write a single entry to that event log source, OR
Create the registry key for your event source directly

When your installer writes to the event log, the source will be created and will be available for non-administrators.

With WiX, (Windows Installer Xml) you can reference this post for directly creating the event source registry entry.

Related Solutions

Git – How to have ‘git log’ show filenames like ‘svn log -v’

For full path names of changed files:

git log --name-only

For full path names and status of changed files:

git log --name-status

For abbreviated pathnames and a diffstat of changed files:

git log --stat

There are a lot more options. Check out the documentation.

When to use the different log levels

I generally subscribe to the following convention:

Trace - Only when I would be "tracing" the code and trying to find one part of a function specifically.
Debug - Information that is diagnostically helpful to people more than just developers (IT, sysadmins, etc.).
Info - Generally useful information to log (service start/stop, configuration assumptions, etc). Info I want to always have available but usually don't care about under normal circumstances. This is my out-of-the-box config level.
Warn - Anything that can potentially cause application oddities, but for which I am automatically recovering. (Such as switching from a primary to backup server, retrying an operation, missing secondary data, etc.)
Error - Any error which is fatal to the operation, but not the service or application (can't open a required file, missing data, etc.). These errors will force user (administrator, or direct user) intervention. These are usually reserved (in my apps) for incorrect connection strings, missing services, etc.
Fatal - Any error that is forcing a shutdown of the service or application to prevent data loss (or further data loss). I reserve these only for the most heinous errors and situations where there is guaranteed to have been data corruption or loss.

Best Answer

Related Solutions

Git – How to have ‘git log’ show filenames like ‘svn log -v’

When to use the different log levels

Related Topic