You can use the EventLogInstaller.Log property to associate the source you specify in the EventLogInstaller.Source property with either an existing log or a new log on the local computer. The Installer Tool (Installutil.exe) uses this information to map the source to the log in the computer's registry. Applications and services should write to the Application log or a custom log. Device drivers should write to the System log.

To write entries to an event log, you must create a source and register it with an event log. An event source can only write to one log at a time. The installer uses the value of the EventLogInstaller.Source property to register your application with the event log as a valid source of entries. If you do not specify a log name before the installer runs, the installer registers your source to the Application log. If you specify a new source and an existing log, the installer creates a new event source and associates it with the log you specify. If you specify both a new source and a new log, the installer associates the new source with the new log in the registry, but the log is not created until the first entry is written to it.

The operating system stores event logs as files. When you use System.Diagnostics.EventLogInstaller or the erload:System.Diagnostics.EventLog.CreateEventSource method to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the EventLogInstaller.Log property with the ".evt" file name extension.

Use System.Diagnostics.EventLogInstaller to register a new source for a new or existing event log; do not use System.Diagnostics.EventLogInstaller to change an existing source. The System.Diagnostics.EventLogInstaller class does not modify the configuration properties of an existing source to match the specified installation properties. The EventLogInstaller.Install(IDictionary) method throws an exception if the EventLogInstaller.Source property matches a source name that is registered for a different event log on the computer. The EventLogInstaller.Install(IDictionary) method does not register the source if the EventLogInstaller.Source property matches a source name that is already registered for the same event log specified in the EventLogInstaller.Log property.

For more detailed information about the behaviors of event logs and sources, see the System.Diagnostics.EventLog class documentation for the EventLog.Log and EventLog.Source properties.