Three log files exist by default on the server: Application, System, and Security. Applications and services use the Application log file. Device drivers use the System log file. The system generates success and failure audit events in the Security log when auditing is turned on. If you have other applications installed, like Active Directory on Windows servers, there might be other default log files. In addition, you can create custom log files on a local or remote computer. Custom logs help organize your entries in a more detailed way than is allowed when your components write events to the default Application log.

If you write to an event log, it is not enough to specify the EventLog.Log property. You must associate a EventLog.Source property with your event log resource to connect it to a particular log. It is not necessary to specify a EventLog.Source when only reading from a log, but an event source must be associated with the event log resource in the server's registry. You can specify only the EventLog.Log name and EventLog.MachineName (server computer name) to read from it.

If the EventLog.Source property has not been specified, a call to EventLog.Log returns an empty string if EventLog.Log has not been explicitly set (by setting the EventLog.Log property, or through the constructor). If the EventLog.Source has been specified, EventLog.Log returns the name of the log to which that source was registered.

A source can only be registered to one log at a time. If the EventLog.Source property was set for an instance of System.Diagnostics.EventLog, you cannot change the EventLog.Log property for that System.Diagnostics.EventLog without changing the value of EventLog.Source or calling EventLog.DeleteEventSource(string) first. If you change the EventLog.Log property after the EventLog.Source property has been set, writing a log entry throws an exception.

The operating system stores event logs as files. When you use System.Diagnostics.EventLogInstaller or erload:System.Diagnostics.EventLog.CreateEventSource to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the EventLog.Log property with the ".evt" file name extension.

You cannot create a new log using the EventLog.Log property alone (without specifying a source for the log). You can call erload:System.Diagnostics.EventLog.CreateEventSource, passing in a new log name as a parameter, and then call EventLog.DeleteEventSource(string). However, the intent is usually either to create (and write entries to) new application-specific logs, or to read from existing logs.

If the EventLog.Log value changes, the event log is closed and all event handles are released.