EventLog Intermittent Exception

Question

Hi,

I have an intermittent problem with some code that writes to a Windows Event Log, using C# and .Net's EventLog class.

Basically, this code works day-to-day perfectly, but very occasionally, we start getting errors like this:

"System.ArgumentException: Only the first eight characters of a custom log name are significant, and there is already another log on the system using the first eight characters of the name given. Name given: 'Application', name of existing log: 'Application'."

I can identify from the other information on our logs that the call stack effected is like this - You can clearly see I am in fact trying to write to an existing 'LB_Email' log (LogEmail is called first):

public static void LogEmail(string to, string type)
{
    string message = String.Format("{0}\t{1}\t{2}", DateTime.Now, to, type);
    Log(message, "LB_Email", EventLogEntryType.Information);
}

private static void Log(string message, string logName, EventLogEntryType type)
{
    using (EventLog aLog = new EventLog())
    {
        aLog.Source = logName;
        aLog.WriteEntry(message, type);
    }
}

Once the errors start occurring, it seems like access to our 'LB_Email' eventlog is locked somehow - viewing properties on the particular eventlog shows most information greyed-out and unchangeable, and other processes appear to be prevented from logging to that log too. However, I am seeing the error (which uses the same Log method above) via a try-catch that logs to an 'LB_Error' log, and that continues to function as expected.

I am calling this code from a multi-threaded application, but I have been unable to identify if the code above is thread-safe or not.

I can also confirm that the log in question is working again fine after killing and restarting the process... and it had appropriate settings to reuse entries when it got full... though I don't think that was the issue.

I'd love to hear your thoughts and suggestions, Nij

Answer 1

The documentation states that:

You can only use the Source to write to one log at a time

So I suspect this problem is caused by your multithreaded app calling the Log method more that once at a given time and for the same Source.

I suggest that, instead of a static class (or methods), you use a thread-safe singleton class for logging these events.

EDIT:

Jon Skeet has an excellent article on singletons.

If you don't want to implement a singleton class you can do something like this:

    static readonly object lockObj = new object();

    public static void LogEmail(string to, string type)
    {
        string message = String.Format("{0}\t{1}\t{2}", DateTime.Now, to, type);
        Log(message, "LB_Email", EventLogEntryType.Information);
    }

    private static void Log(string message, string logName, EventLogEntryType type)
    {
        lock (lockObj)
        {
            using (EventLog aLog = new EventLog())
            {
                aLog.Source = logName;
                aLog.WriteEntry(message, type);
            }
        }
    }

Hope this solves your problem.

Answer 2

Thanks Bruno,

So, am I mistaken in thinking that the EventLog instance in the Log method is different from the EventLog instance in the same method call in a different thread? Or am I just getting confused about object instances inside a static method?

OK, so I have several wrapper methods to the Log(...) method. If I moved the Log method into a singleton class, changed the wrappers (LogEmail, LogXxxx, LogYyy etc then I could keep my Log.Zzzz interfaces the same, but leverage the security of the singleton LogSingleton.Instance.Log(...) from the current Logs. OR because I want to write to different logs, would each one require its own LogSingletonXxx?

You can tell I'm confused :) Yes - I'd really appreciate some synchronisation code :)

Nij