Use the System.Diagnostics.EventSourceCreationData class to configure a new source for writing localized entries to an event log. It is not necessary to use this class to read from an event log.

This class defines the configuration settings for a new event source and its associated event log. The associated event log can be on the local computer or a remote computer. To create a new source for a new or existing event log on the local computer, set the EventSourceCreationData.LogName and EventSourceCreationData.Source properties of an System.Diagnostics.EventSourceCreationData and call the EventLog.CreateEventSource(EventSourceCreationData) method. This method creates the event source you specify in the EventSourceCreationData.Source property and registers it for the event log specified in EventSourceCreationData.LogName. This behavior is similar to using the System.Diagnostics.EventLogInstaller class to register an event source for an event log.

Use the erload:System.Diagnostics.EventLog.WriteEvent and erload:System.Diagnostics.EventLog.WriteEntry methods to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.

Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configurations. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an System.Diagnostics.EventLogInstaller, or using the erload:System.Diagnostics.EventLog.CreateEventSource method. You must have administrative rights on the computer to create a new event source.

You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.

Each source can only write to one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might need multiple sources configured for different event logs or different resource files.

To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.

You can register the event source with localized resources for your event category and message strings. Your application can write event log entries using resource identifiers, rather than specifying the actual string. The Event Viewer uses the resource identifier to find and display the corresponding string from the localized resource file based on current language settings. You can register a separate file for event categories, messages, and parameter insertion strings, or you can register the same resource file for all three types of strings. Use the EventSourceCreationData.CategoryCount, EventSourceCreationData.CategoryResourceFile, EventSourceCreationData.MessageResourceFile, and EventSourceCreationData.ParameterResourceFile properties to configure the source to write localized entries to the event log. If your application writes string values directly to the event log, you do not need to set these properties.

The source must be configured either for writing localized entries or for writing direct strings. The erload:System.Diagnostics.EventLog.WriteEntry method writes the given string directly to the event log; it does not use a localizable message resource file. Use the erload:System.Diagnostics.EventLog.WriteEvent method to write events using a localized message resource file.

If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the erload:System.Diagnostics.EventLog.WriteEvent method to write entries using resource identifiers to the event log. Then create a different source without resource files and use that source in the erload:System.Diagnostics.EventLog.WriteEntry method to write strings directly to the event log using that source.

Namespace: System.Diagnostics
Assembly: System (in System.dll)
Assembly Versions: 2.0.0.0, 4.0.0.0
Since: .NET 2.0