views:

138

answers:

1

Hello,

I have an ISAPI application that needs to write to the standard windows event log. The code works just fine when in a user mode process but, as soon as it runs from the ISAPI application, it generates an access denied error when calling RegisterEventSource (no matter what event source I pass it: "Application" fails as surely as anything else).

Server platform is IIS7 on windows 2003, language is Borland Delphi 6.

Edit: Code was requested so here it is:

procedure TExtendedEventLogger.LogMessage(Message: String; EventType: DWord;
  Category: Word; ID: DWord);
var
  P: Pointer;
  USID: TUserSID;
begin
  if Enabled then
  begin
    P := PChar(Message);
    if FEventLog = 0 then
    begin
      If FMachine <> '' then
        FEventLog := windows.RegisterEventSource(PChar(FMachine), PChar(FName))
      else
        FEventLog := windows.RegisterEventSource(nil, PChar(FName)); // <- blows up here
      if FEventLog = 0 then
      begin
        Raise exception.Create('Event logging error: ' + SysErrorMessage(getLastError));
      end;
    end;
    USID := GetCurrentUserSid();
    try
      if not ReportEvent(FEventLog, EventType, Category, ID, USID.PSID, 1, 0, @P, nil) then
        raiseLastOSError;
    finally
      FreeAndNil(USID);
    end;
  end;
end;
+1  A: 

I believe a similar problem is described here. Check the permissions to the registry key, you can do that with regedit, too.

TOndrej
Thanks for that answer.That strikes me as a rather hawkward way to do it. I'm not questioning the validity of that answer as such, mind you, but I can't bring myself to beleive MS designed a critical part of the system like the event log so poorly that no web application can write to it without first changing the default permission.Have I missed something obvious, here ?
Stephane
Some might say a system which allows any process to write to the event log by default is poor design. Possible denial of service attack by filling up the event log/hard disk? Honestly, I'm not sure.
TOndrej
If you're running a local process on the server, even with low privilege, you can still do pretty nasty things and even crash the system (for instance, you can create a threads in a loop with a very small stack size: that will create so many threads that, in a very short time, the scheduler will not be able to handle it and the system will hang).On the other hand, requiring that a web application provides it's own logging mechanism (that cannot be aggregated in a standard way) if raising the bar for providing a safe environment.Not that this helps me much with my problem, mind you :P
Stephane