Security Issues Writing to Event Log with My.Application.Log.WriteException

Question

I'm handling the Application.UnhandledException event in a WinForms app and need to log exceptions caught there. My app.config is set up to log exceptions to a FileLog and an EventLog.

The problem is that when running as a non-admin user, the EventLog cannot be written to because of a SecurityException - I get the message "The source was not found, but some or all event logs could not be searched."

I understand why - the user does not have permission to create the EventLog source, but the question is how should this source be created? As I see it, I could either:

1) Create the EventLog source with my installer, as this is running as admin. How to do this?

2) Create from within my app, by somehow elevating permissions? But this would give the UAC prompt on Vista.

What's the best practice for creating a Windows Application EventLog source on a client machine?

thanks

Answer 1

The most common way to do this is your Option 1.

How you do it depends on your installer package, but you need to:

1. Ensure your installer runs with elevated permission.
2. Write a single entry to that event log source, OR
3. Create the registry key for your event source directly

When your installer writes to the event log, the source will be created and will be available for non-administrators.

With WiX, (Windows Installer Xml) you can reference this post for directly creating the event source registry entry.