Does one need to manually create a Windows event log source when installing a Windows service.

Question

I have developed a Windows service in C#. I have created a installer with Visual Studio 2008, which installs the Windows service. Everything is good so far. I want to make sure that the event source has been created at install time, so that any error/exception conditions at runtime are correctly logged to the Windows event log.

Does the event source get automatically created (and removed) as part of the windows service installation (and uninstallation), or do I have to handle this myself and create a custom action to create and delete it as follows?

protected override void OnBeforeInstall(IDictionary savedState)
{
    base.OnBeforeInstall(savedState);

    if (!EventLog.SourceExists(ServiceName))
        EventLog.CreateEventSource(ServiceName, "Application");
}

protected override void OnAfterUninstall(IDictionary savedState)
{
    base.OnAfterInstall(savedState);

    if (EventLog.SourceExists(ServiceName))
        EventLog.DeleteEventSource(ServiceName);
}

Answer 1

You should register them during install, because the service account might not have the privilege to do so during runtime: How to: Add Your Application as a Source of Event Log Entries:

By default, if you try to write an entry without first having registered your component as a valid source, the system automatically registers the source with the event log, using the value of the Source property as the source string. In general, create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources and you attempt to write an event with the new source, the write operation will fail. If creating the source during installation is not an option, then try to create the source well ahead of the first write operation, perhaps during your application initialization. If you choose this approach, be sure your initialization code is running with administrator rights on the computer. These rights are required for creating new event sources

Luckily the ServiceInstaller makes it really easy, as you already found out.

Answer 2

It appears to me like the ServiceInstaller automatically creates a DataSource during installation with the same name as the service, so there's no need for any extra code.

From the ServiceInstaller documentation

When the installation is performed, it automatically creates an EventLogInstaller to install the event log source associated with the ServiceBase derived class. The Log property for this source is set by the ServiceInstaller constructor to the computer's Application log. When you set the ServiceName of the ServiceInstaller (which should be identical to the ServiceBase..::.ServiceName of the service), the Source is automatically set to the same value. In an installation failure, the source's installation is rolled-back along with previously installed services.