Custom Event Logs

One of the neat things that the EventLog object enables you to do is create custom event logs and write to them on the fly. To do this, however, you must first check to see whether the log that you want to write to already exists or whether you need to create it. As you’ll see in Listings 8.3 and 8.4, only a few extra lines of code are needed.

Listing 8.3. Creating a Custom Event Log and Logging an Entry in It (C#)

<%@ Page Language="C#" %> 
<%@ Import Namespace="System.Diagnostics" %> 

<% 
      EventLog el = new EventLog(); 

      el.MachineName = "."; //local computer 
      el.Source = "Test Source"; 
      el.Log = "Test Log"; 

      if (!EventLog.SourceExists(el.Source)) 
      {
           //Event source doesn't exist, so create a new one 
           EventLog.CreateEventSource(el.Source,el.Log); 
      } 

      el.WriteEntry("Just look at me now!",EventLogEntryType.Information,12); 
      el.Close(); 

      Response.Write("Done!"); 
%> 

Listing 8.4. Creating a Custom Event Log and Logging an Entry in It (Visual Basic .NET)

<%@ Page Language="VB" %> 
<%@ Import Namespace="System.Diagnostics" %> 

<% 
     Dim el As EventLog = New EventLog() 

     el.MachineName = "." 'local computer 
     el.Source = "Test Source" 
     el.Log = "Test Log" 

     If Not EventLog.SourceExists(el.Source) Then 
          'Event source doesn't exist, so create a new one 
          EventLog.CreateEventSource(el.Source,el.Log) 
     End If 

     el.WriteEntry("Just look at me now!",EventLogEntryType.Information, _ 
           12 
     el.Close() 

     Response.Write("Done!") 
%> 

You should note a few interesting things about the code just shown. First, contrary to the previous examples so far, you actually create an instance of the EventLog object here rather than using Static methods of the EventLog class. Next, you set a few properties of the EventLog instance. You then feed the Source property of your EventLog instance into the Static SourceExists method of the EventLog class. If a Boolean false value is returned from the method (meaning that the source does not exist in the Windows 2000 Event Log), then you can call the CreateEventSource static method to create it. You then can call the WriteEntry method of your EventLog instance to write an entry to your custom event log.

The WriteEntry method has several overloaded method signatures, but the one that is used here takes three parameters. The first parameter is the actual message that you want to write to your custom event log. The second parameter is a typed Enum (short for enumeration). The possible values for the EventLogEntryType are as follows:

Error

FailureAudit

Information

SuccessAudit

Warning

You should use the Error |value when something has definitely gone wrong with your web application. Use the Information value when something happens in your web application that might not be a problem but that you just want to know about it. Use the Warning value when something bad is about to happen or when something (or somebody) is trying to do something that is not supposed allowed. The other two values, FailureAudit and SuccessAudit, are used for logging to the security log and will not be discussed here.

The final parameter to the WriteEntry method is the event ID. This parameter is a Short datatype and can contain any numerical value that you want to pass in. It is just another way to logically separate unique event types. Remember that you already specified the machine name, source, and log to for your EventLog object instance, so these values take part in the WriteEntry method as well. A final important thing to remember is that you must call the Close method of your EventLog object to release the read and write memory handles to the event log. Figure 8.2 shows the custom event log that you just created.

Notice in the figure that you just created a new custom event log named Test Log in the Windows 2000 Event Log Viewer tree node under System Tools.You can also see the Test Source value in the Source field and the value 12 in the Event field . If you double-clicked on this event, you would see a figure similar to Figure 8.1 that shows your new message in the Description box.