写入Windows应用程序事件日志

本文介绍了写入Windows应用程序事件日志的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述

是否可以写入此事件日志:

或者至少是其他一些Windows默认日志，我不必注册事件源?

解决方案

是的，有一种方法可以写入要查找的事件日志.您无需创建新的源，只需简单地使用现有的源，该源通常与EventLog的名称相同，并且在某些情况下，例如事件日志Application，可以在没有管理特权的情况下访问*.

*其他无法直接访问的情况是安全事件日志，例如，只能由操作系统访问.

我使用此代码直接写入事件日志应用程序:

using (EventLog eventLog = new EventLog("Application")) { eventLog.Source = "Application"; eventLog.WriteEntry("Log message example", EventLogEntryType.Information, 101, 1); }

如您所见，EventLog源与EventLog的名称相同.可以在 Windows中的事件源中找到其原因.开发人员中心(我将涉及源名称的部分加粗了):

Eventlog项中的每个日志都包含称为事件源的子项.事件源是记录事件的软件的名称. 通常是应用程序的名称，如果应用程序很大，通常是应用程序的子组件的名称.您最多可以向注册表添加16,384个事件源.

Is there a way to write to this event log:

Or at least, some other Windows default log, where I don't have to register an event source?

解决方案

Yes, there is a way to write to the event log you are looking for. You don't need to create a new source, just simply use the existent one, which often has the same name as the EventLog's name and also, in some cases like the event log Application, can be accessible without administrative privileges*.

*Other cases, where you cannot access it directly, are the Security EventLog, for example, which is only accessed by the operating system.

I used this code to write directly to the event log Application:

using (EventLog eventLog = new EventLog("Application")) { eventLog.Source = "Application"; eventLog.WriteEntry("Log message example", EventLogEntryType.Information, 101, 1); }

As you can see, the EventLog source is the same as the EventLog's name. The reason of this can be found in Event Sources @ Windows Dev Center (I bolded the part which refers to source name):

Each log in the Eventlog key contains subkeys called event sources. The event source is the name of the software that logs the event. It is often the name of the application or the name of a subcomponent of the application if the application is large. You can add a maximum of 16,384 event sources to the registry.