Nlog: EventLogTarget always logs to application log

[chdev2412]

In my project (ASP.NET C# class library project) , we are using NLog.dll (v 4.0.0.0) to log exceptions in eventviewer, in the below manner.

``` c#
private readonly NLog.Logger _logger;
_logger = LogManager.GetCurrentClassLogger();
_logger.Error(someText, someArgs);

Please find the NLog configurations used as below :

``` xml
  <target xsi:type="EventLog"
          name="eventlog"
          layout="${message}"
          machineName="."
          source="NLogLogger"
          log="Application"  />

It works fine and logs messages in the Application log inside “Windows Logs”.
However, we require the logging to be performed in a separately designated log (custom log, specific for my application) .

We specified the name of the designated log in the config like below.

  <target xsi:type="EventLog"
          name="eventlog"
          layout="${message}"
          machineName="."
          source="NLogLogger"
          log=“MyOwnLog” />

But it still logs messages in the same Application log.

Please let me know how I can get it logged in the designated log.

[304NotModified]

I can reproduce this, but the code looks good.

Think this is the same issue. http://bytes.com/topic/c-sharp/answers/262283-eventlog-always-writes-application-log

Don't get it.

EventLog.SourceExists("dell")
returns in true

This writes to "application" and not to "dell":

Has someone an idea what's wrong? Is it a security permission thing?

[304NotModified]

@epignosisx Ever seen this bug?

[stile17]

I think the problem is related to:

From MSDN
If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

When I was testing nlog.config my first approach was to omit the "log" attribute. Messages was sent to "Application" log. My next thing to test was my custom log "MyOwnLog" but i left the same source name, and messages was also sending to "Application" log. Bummer :(

When I changed the log name and source name at the same time everything worked correctly.

Look out for name of event log, only first eight signs is important ;)

_Please correct my english if I made terrible mistakes._

[304NotModified]

Thanks @stile17

I think your are right. But can you give an example in nlog.configs? That would help fully understanding it.

PS: your English is good to follow. :+1:

[stile17]

First attempt (messages are writing to Application log):

<target xsi:type="EventLog"
                name="EventLog"
                source="MyNameEventLog"
                machineName="."
                layout="${message}${newline}${exception:format=ToString}"/>

Improvement (message are still writing to Application log):

<target xsi:type="EventLog"
                name="EventLog"
                source="MyNameEventLog"
                log="MyNameEventLog"
                machineName="."
                layout="${message}${newline}${exception:format=ToString}"/>

Solution (messages are writing to "NewNameEventLog" log):

<target xsi:type="EventLog"
                name="EventLog"
                source="NewNameEventLog"
                log="NewNameEventLog"
                machineName="."
                layout="${message}${newline}${exception:format=ToString}"/>

Solution (alternate) using powershell and removing "MyNameEventLog", next restarting computer, than this nlog.config begin to write messages to "MyNameEventLog":

<target xsi:type="EventLog"
                name="EventLog"
                source="MyNameEventLog"
                log="MyNameEventLog"
                machineName="."
                layout="${message}${newline}${exception:format=ToString}"/>

[UgurAldanmaz]

Anyone working? I want to work on it if anyone did not start yet.

[304NotModified]

That would be great!

[UgurAldanmaz]

I have tested with Log name that different than Application. As @stile17 said, it works.
Logs can be viewed with Event Viewer, under the "Application and Services Logs" node.

It seems that there is no bug, but we can add a feature to log into custom directories. Such as Application and Services Logs / Microsoft / Windows / etc... (It is also mentioned in #1151)

But I am not sure that Windows Event Log actually log into directories. Maybe Event Viewer gives the directory view. Also I did not see Regedit records for Microsoft / Windows / etc.. directories.

What do you think about to develop this feature?

[304NotModified]

It seems that there is no bug, but we can add a feature to log into custom directories.

It would be great to add this feature! :) Please do! :+1:

[UgurAldanmaz]

Okay, I will investigate. Again, I am not sure if it is possible :)

(I will create an issue for this feature, if it is possible.)

[jamers99]

Any update on this? Will this be done? It would be nice!

[snakefoot]

Windows EventLog is special. Since the idea of multiple EventLogs is just a shim. All EventLog-items are stored in the same blob.

The Windows Registry Database controls where the LogEvents from registered EventLog-source should be shown. This gives the illusion of having multiple EventLogs, but it is actually more like a category.

A single EventLog-source can only exist in a single EventLog (or category). If having registered an EventLog-source to write into a special EventLog, then it cannot write to another EventLog.

Anyways if you find some gold nuggets that can improve NLog EventLog, then please create a pull-request.

P.S. Using NLog myself for writing into multiple named EventLogs, and it works just fine. But just need to use unique EventLog-Source for each EventLog (or category).

[304NotModified]

I think we could close this. Im pretty sure that the code is correct.

I prefer adding (mocked) unit tests for this, but not sure if that's needed

[snakefoot]

Think both me and @stile17 agree that this is not an issue in NLog EventLog Target.

It is because Windows EventLog is special, so one EventLog-source can only write to a single EventLog.

[304NotModified]

Ok close :) thanks!

[stile17]

I agree with @snakefoot that this is not an issue with NLog :)

But for me the main OP issue is that mapping between source and target EventLog cannot be changed without restarting Windows so its rather Windows issue ;)

[shafiqdev]

restarting the Windows EventLog service solved this problem for me. no system reboot required.

[TYZhenn]

maybe you can check if you install NLog.WindowsEventLog package
right at the beginning of this page
https://github.com/NLog/NLog/wiki/EventLog-target