What's the primary use of Windows Event Viewer?

Question

Hi all,

Just wondering what everybody's opinion is on the Windows Admin tool Event Viewer?

I'm writing a WCF application at the moment and have started logging errors to the windows event viewer when I handle them. I then started thinking, should I be logging more than just errors, such as when a user has logged in or out or would you go further logging even more activity?

Or is this a tool that's mainly used for testing without using the debugger?

Any input appreciated:-)

Answer 1

Overall I would say it depends on your program and intended audience. For example an application used by the US government (specifically DOD) will have to log certain events to a log (the windows event log most likely) to meet security requirements.

Not knowing how you are doing the logging now, I would suggest that you use a logging framework like log4net to do your application logging. That away at runtime you can tailor what is logged and where it is logged to. This will be of tremendous help with debugging issues/errors on a production system or for that matter in testing if you don't have a debugger that can be used in testing.

Answer 2

The windows event log is a common destination for applications to log errors and information messages. Of course company standards, operations preferences, and non-functional requirements all come in to play in deciding on a log destination.

It's perfectly valid to dump out informational or debug messages to the event log but typically this would be configuration based so that the log would not be filled with debug messages when they are not required. Common frameworks to do this would be log4net or Enterprise Library.

The event log does have some negatives:

• Usually the registry keys need to be setup in advance since many applications will not have permissions to create the keys at runtime (e.g. ASP.NET)
• The log can fill up preventing the logging of your messages
• The log can be set to roll over which can cause older entries to be lost
• The size of the log entry is limited (to 32767 characters, I think) so large entries will be truncated (e.g. if logging large WCF message)