System [00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00] 1.0.3300.0 1.0.5000.0 2.0.0.0 4.0.0.0 Gtk# is thread aware, but not thread safe; See the <link location="node:gtk-sharp/programming/threads">Gtk# Thread Programming</link> for details. System.ComponentModel.Component System.ComponentModel.ISupportInitialize System.ComponentModel.DefaultEvent("EntryWritten") System.ComponentModel.InstallerType(typeof(System.Diagnostics.EventLogInstaller)) System.Diagnostics.MonitoringDescription("Represents an event log")

lets you access or customize Windows event logs, which record information about important software or hardware events. Using , you can read from existing logs, write entries to logs, create or delete event sources, delete logs, and respond to log entries. You can also create new logs when creating an event source.

If the for the event log associated with the instance does not exist, a new event source is created. To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges.

The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a is thrown.

Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.

Creating an object, writing an entry, then passing the object to partially trusted code can create a security issue. Never pass any event log object, including and objects, to less trusted code.

In versions 1.0 and 1.1 of the .NET Framework, this class requires immediate callers to be fully trusted. In version 2.0 this class requires for specific actions. It is strongly recommended that not be granted to partially trusted code. The ability to read and write the event log allows code to perform actions such as issuing event log messages in the name of another application.

Creating or deleting an event source requires synchronization of the underlying code by using a named mutex. If a highly privileged application locks the named mutex, attempts to create or delete an event source causes the application to stop responding until the lock is released. To help avoid this problem, never grant permission to untrusted code. In addition, permission potentially allows other permissions to be bypassed and should only be granted to highly trusted code.

To read from a log, specify the name and (server computer name) for the . It is not necessary to specify the , as a source is required only for writing to logs. The member is automatically populated with the event log's list of entries.

You are not required to specify the if you are connecting to a log by specifying a / pair. If you do not specify the , the local computer, ".", is assumed.

If you write to an event log, you must specify or create an event . You must have administrative rights on the computer to create a new event source. The registers your application with the event log as a valid source of entries. You can only use the to write to one log at a time. The can be any random string, but the name must be distinct from other sources on the computer. It is common for the source to be the name of the application or another identifying string. An attempt to create a duplicated value throws an exception. However, a single event log can be associated with multiple sources.

There is nothing to protect an application from writing as any registered source. If an application is granted permission, it can write events for any valid source registered on the computer.

Applications and services should write to the Application log or a custom log. Device drivers should write to the System log. If you do not explicitly set the property, the event log defaults to the Application log.

The Security log is read-only.

Use and to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.

Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files. To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.

You can register the event source with localized resources for your event category and message strings. Your application can write event log entries using resource identifiers, rather than specifying the actual string values. Refer to the and classes for more information on configuring your source with resource files.

If your application writes string values directly to the event log, you do not need to set the resource file properties for the source. The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

When writing events, you must at least specify either a message string or the resource identifier for a message string. Other event properties are optional. Examples of optional event settings include the following: you can set the to specify the icon that the Event Viewer displays for the entry; you can specify a category identifier for the event, if your application uses categories for filtering the events; and you can also attach binary data to your event entry if you need to associate additional information with a given event.

In addition to accessing individual event logs and their entries, the class provides access to the collection of all event logs. You can use the static members of to delete logs, get log lists, create or delete a source, or determine if a computer already contains a particular source.

There are three default event logs: Application, System, and Security. Other installed applications and services, such as Active Directory, can have additional event logs. You can use to create custom event logs that you can view through the server's Event Viewer. Use the method to display a localized name for your event log in the Event Viewer. Use the method to configure the behavior of your event log when it reaches its maximum log size.

Event logging consumes disk space, processor time, and other system resources. It is important to log only essential information. It is recommended that you place event log calls in an error path, rather than in the main code path, so as not to adversely affect performance.

For a list of initial property values for an instance of , see the constructor.

Provides interaction with Windows event logs.

- Constructor
  1.0.5000.0
  2.0.0.0
  4.0.0.0

  Before calling , specify the property of the instance. If you are only reading from the log, you can alternatively specify only the and properties.

  If you do not specify a , the local computer (".") is assumed.

  The following table shows initial property values for an instance of .

  Property

  Initial Value

  An empty string ("").

  An empty string ("").

  The local computer (".").

  Initializes a new instance of the class. Does not associate the instance with any log.

- Constructor
  1.0.5000.0
  2.0.0.0
  4.0.0.0

  This overload sets the property to the parameter. Before calling , specify the property of the instance. If you are only reading from the log, you can alternatively specify only the and properties.

  If you do not specify a , the local computer (".") is assumed. This overload of the constructor specifies the property, but you can change this before reading the property.

  If the source you specify in the property is unique from other sources on the computer, a subsequent call to creates a log with the specified name, if it does not already exist.

  The following table shows initial property values for an instance of .

  Property

  Initial Value

  An empty string ("").

  The parameter.

  The local computer (".").

  Initializes a new instance of the class. Associates the instance with a log on the local computer.

  The name of the log on the local computer.
- Constructor
  1.0.5000.0
  2.0.0.0
  4.0.0.0

  This overload sets the property to the parameter and the property to the parameter. Before calling , specify the property of the . If you are only reading from the log, you can alternatively specify only the and properties.

  This overload of the constructor specifies the and properties, but you can change either before reading the property.

  The following table shows initial property values for an instance of .

  Property

  Initial Value

  An empty string ("").

  The parameter.

  The parameter.

  Initializes a new instance of the class. Associates the instance with a log on the specified computer.

  The name of the log on the specified computer.
  The computer on which the log exists.
- Constructor
  1.0.5000.0
  2.0.0.0
  4.0.0.0

  This constructor sets the property to the parameter, the property to the parameter, and the property to the parameter. The property is required when writing to an event log. However, if you are only reading from an event log, only the and properties are required (as long as the event log on the server has a source already associated with it). If you are only reading from the event log, another overload of the constructor might suffice.

  The following table shows initial property values for an instance of .

  Property

  Initial Value

  The parameter.

  The parameter.

  The parameter.

  Initializes a new instance of the class. Associates the instance with a log on the specified computer and creates or assigns the specified source to the .

  The name of the log on the specified computer
  The computer on which the log exists.
  The source of event log entries.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void

  The vsprvslong design environment uses this method to start the initialization of a component used on a form or by another component. The method ends the initialization. Using the and methods prevent the control from being used before it is fully initialized.

  Begins the initialization of an used on a form or used by another component. The initialization occurs at runtime.

- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void

  Event logs are set with a maximum size that determines how many entries they can contain. When an event log is full, it stops recording new event information or begins to overwrite earlier entries. If event recording stops, you can use this method to clear the log of existing entries and allow it to start recording events again. You must have administrator permissions to the computer on which the log resides to clear event log entries.

  closes the event log, releases the event handles, retrieves new read and write handles, and reopens the event log. Events received after the call to the method are not cleared along with the existing events.

  Removes all entries from the event log.

- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void

  The method is called by the protected method. You do not need to invoke before calling .

  Closes the event log and releases read and write handles.

- Method
  2.0.0.0
  4.0.0.0
  System.MonoNotSupported("remote machine is not supported")
  System.Void ``

  Use this overload to configure a new source for writing entries to an event log on the local computer or a remote computer. It is not necessary to use this method to read from an event log.

  The method uses the input , and properties to create registry values on the target computer for the new source and its associated event log. A new source name cannot match an existing source name or an existing event log name on the target computer. If the property is not set, the source is registered for the Application event log. If the is not set, the source is registered on the local computer.

  To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges.

  The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a is thrown.

  Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.

  Use and to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.

  The operating system stores event logs as files. When you use or to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the property with the ".evt" file name extension.

  Each source can only write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.

  You can register the event source with localized resource file(s) for your event category and message strings. Your application can write event log entries using resource identifiers, rather than specifying the actual string. The Event Viewer uses the resource identifier to find and display the corresponding string from the localized resource file based on current language settings. You can register a separate file for event categories, messages and parameter insertion strings, or you can register the same resource file for all three types of strings. Use the , , , and properties to configure the source to write localized entries to the event log. If your application writes strings values directly to the event log, you do not need to set these properties.

  The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.

  If a source is configured for an event log, and you reconfigure it for another event log, you must restart the computer for the changes to take effect.

  Establishes a valid event source for writing localized event messages, using the specified configuration properties for the event source and the corresponding event log.

  The configuration properties for the event source and its target event log.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` ``

  Use this overload to create a custom log or to create and register a to an existing log on the local computer.

  If is null or an empty string ("") when you call , the log defaults to the Application log. If the log does not exist on the local computer, the system creates a custom log and registers your application as a for that log.

  To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges.

  The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a is thrown.

  In Windows Vista and later, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.

  You only need to create an event source if you are writing to the event log. Before writing an entry to an event log, you must register the event source with the event log as a valid source of events. When you write a log entry, the system uses the to find the appropriate log in which to place your entry. If you are reading the event log, you can either specify the , or a and .

  You are not required to specify the if you are connecting to a log on the local computer. If you do not specify the when reading from a log, the local computer (".") is assumed.

  Use and to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.

  The operating system stores event logs as files. When you use or to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the property with the ".evt" file name extension.

  The source must be unique on the local computer; a new source name cannot match an existing source name or an existing event log name. Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.

  The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.

  If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

  Establishes the specified source name as a valid event source for writing entries to a log on the local computer. This method can also create a new custom log on the local computer.

  The source name by which the application is registered on the local computer. The name of the log the source's entries are written to. Possible values include Application, System, or a custom event log.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Obsolete("use CreateEventSource(EventSourceCreationData) instead")
  System.Void `` `` ``

  Use this overload to create a custom log or to create and register a to an existing log on the specified computer.

  If is null or an empty string ("") when you call , the log defaults to the Application log. If the log does not exist on the specified computer, the system creates a custom log and registers your application as a for that log.

  You only need to create an event source if you are writing to the event log. Before writing an entry to an event log, you must register the event source with the event log as a valid source of events. When you write a log entry, the system uses the to find the appropriate log in which to place your entry. If you are reading the event log, you can either specify the , or a and .

  To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges.

  The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. In Windows Vista and later, users do not have permission to access the security log; therefore, a is thrown.

  In Windows Vista and later, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.

  Use and to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.

  The operating system stores event logs as files. When you use or to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the property with the ".evt" file name extension.

  The source must be unique on the local computer; a new source name cannot match an existing source name or an existing event log name. Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.

  The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.

  If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

  Establishes the specified source name as a valid event source for writing entries to a log on the specified computer. This method can also be used to create a new custom log on the specified computer.

  The source by which the application is registered on the specified computer. The name of the log the source's entries are written to. Possible values include Application, System, or a custom event log. If you do not specify a value, defaults to Application. The name of the computer to register this event source with, or "." for the local computer.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void ``

  Use this method when the log you want to delete is on the local computer. You can delete any log on the computer, provided you have the appropriate registry permissions.

  removes the log specified by from the local computer. If you want to delete only the source registered to a log, call . If you only want to delete the log entries, call . and are static methods, so they can be called on the class itself. It is not necessary to create a new instance of to call either method.

  The method first deletes the file that holds the contents of the log. It then accesses the registry and removes all the event sources registered for that log. If you recreate the log at a later point, you should register the event sources again, if they are to be reused. If you do not register the event sources and other users write to an event source without specifying a log name, the event source will be created in the Application event log. Therefore, applications that previously were able to write entries to the log you deleted and recreated will write to the Application log instead, because it now contains the event source.

  Recreating an event log can be a difficult process. Avoid deleting any of the system-created event logs, such as the Application log.

  Deleting a log through a call to automatically deletes the sources registered to that log. This can make other applications using that log inoperative.

  Removes an event log from the local computer.

  The name of the log to delete. Possible values include: Application, Security, System, and any custom event logs on the computer.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.MonoNotSupported("remote machine is not supported")
  System.Void `` ``

  Use this method when the log you want to delete is on a remote computer. You can delete any log on the computer, provided you have the appropriate registry permissions.

  removes the log specified by from the computer specified by . If you want to delete only the source registered to a log, call . If you only want to delete the log entries, call . and are static methods, so they can be called on the class itself. It is not necessary to create an instance of to call either method.

  This method first deletes the file that holds the contents of the log. It then accesses the registry and removes all the event sources registered for that log. If you recreate the log at a later point, you should register the event sources again, if they are to be reused. If you do not register the event sources and other users write to an event source without specifying a log name, the event source will be created in the Application event log. Therefore, applications that previously were able to write entries to the log you deleted and recreated will write to the Application log instead, because it now contains the event source.

  Recreating an event log can be a difficult process. Avoid deleting any of the system-created event logs, such as the Application log.

  Deleting a log through a call to automatically deletes the sources registered to that log. This can make other applications using that log inoperative.

  Removes an event log from the specified computer.

  The name of the log to delete. Possible values include: Application, Security, System, and any custom event logs on the specified computer. The name of the computer to delete the log from, or "." for the local computer.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void ``

  Use this method to remove the registration of a from the local computer. accesses the registry on the local computer and removes the registration of your application as a valid source of events.

  You can remove your component as a valid source of events if you no longer need it to write entries to that log. For example, you might do this if you need to change your component from one log to another. Because a source can only be registered to one log at a time, changing the log requires you to remove the current registration.

  removes only the source registered to a log. If you want to remove the log itself, call . If you only want to delete the log entries, call . and are static methods, so they can be called on the class itself. It is not necessary to create an instance of to call either method.

  Deleting a log through a call to automatically deletes the sources registered to that log. This can make other applications using that log inoperative.

  If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

  Removes the event source registration from the event log of the local computer.

  The name by which the application is registered in the event log system.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.MonoNotSupported("remote machine is not supported")
  System.Void `` ``

  Use this overload to remove the registration of a from a remote computer. accesses the registry on the computer specified by and removes the registration of your application as a valid source of events.

  You can remove your component as a valid source of events if you no longer need it to write entries to that log. For example, you might do this if you need to change your component from one log to another. Because a source can only be registered to one log at a time, changing the log requires you to remove the current registration.

  removes only the source registered to a log. If you want to remove the log itself, call . If you only want to delete the log entries, call . and are static methods, so they can be called on the class itself. It is not necessary to create an instance of to call either method.

  Deleting a log through a call to automatically deletes the sources registered to that log. This can make other applications using that log inoperative.

  If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

  Removes the application's event source registration from the specified computer.

  The name by which the application is registered in the event log system. The name of the computer to remove the registration from, or "." for the local computer.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void ``

  This method is called by the public Dispose() method and the method. Dispose() invokes the protected Dispose(Boolean) method with the parameter set to true. invokes Dispose with set to false.

  When the parameter is true, this method releases all resources held by any managed objects that this references. This method invokes the Dispose() method of each referenced object.

  Releases the unmanaged resources used by the , and optionally releases the managed resources.

  true to release both managed and unmanaged resources; false to release only unmanaged resources.
- Property
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.ComponentModel.Browsable(false)
  System.ComponentModel.DefaultValue(false)
  System.Diagnostics.MonitoringDescription("If enabled raises event when a log is written.")
  System.Boolean To be added: an object of type 'bool'

  The property determines whether the raises events when entries are written to the log. When the property is true, components that receive the event will receive notification any time an entry is written to the log that is specified in the property. If is false, no events are raised.

  You can receive event notifications only when entries are written on the local computer. You cannot receive notifications for entries written on remote computers.

  Gets or sets a value indicating whether the receives event notifications.

- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void

  The vsprvslong design environment uses this method to end the initialization of a component used on a form or by another component. The method starts the initialization. Using the and methods prevents the control from being used before it is fully initialized.

  Ends the initialization of an used on a form or by another component. The initialization occurs at runtime.

- Property
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.ComponentModel.Browsable(false)
  System.ComponentModel.DesignerSerializationVisibility(System.ComponentModel.DesignerSerializationVisibility.Hidden)
  System.Diagnostics.MonitoringDescription("The entries in the log.")
  System.Diagnostics.EventLogEntryCollection To be added: an object of type 'EventLogEntryCollection'

  Use the member when reading from the event log.

  Because the property is read-only, you cannot modify an entry or write to the log using . Instead, specify a and call to write a new log entry. You can use to count the number of entries in the event log, and view each in the collection. Use the indexed member to retrieve information about a specific entry, such as , , , or .

  It is not necessary to specify a when only reading from a log. You can specify only the name and (server computer name) properties for the instance. In either case, the member is automatically populated with the event log's list of entries. You can select the appropriate index for an item in this list to read individual entries.

  An important distinction between reading and writing log entries is that it is not necessary to explicitly call a read method. After the and are specified, the property is automatically populated. If you change the value of the or property, the property is repopulated the next time you read it.

  You are not required to specify the if you are connecting to a log. If you do not specify the , the local computer, ".", is assumed.

  Gets the contents of the event log.

- Event
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Diagnostics.MonitoringDescription("Raised for each EventLog entry written.")
  System.Diagnostics.EntryWrittenEventHandler

  To get event notifications, you must set to true. You can only receive event notifications when entries are written on the local computer. You cannot receive notifications for entries written on remote computers.

  When you create an delegate, you identify the method that will handle the event. To associate the event with your event handler, add an instance of the delegate to the event. The event handler is called whenever the event occurs, until you remove the delegate. For more information about handling events with delegates, see Consuming Events.

  The system responds to only if the last write event occurred at least six seconds previously. This implies you will only receive one event notification within a six-second interval, even if more than one event log change occurs. If you insert a sufficiently long sleep interval (around 10 seconds) between calls to , you are less likely to miss an event. However, if write events occur more frequently, you might not recieve the event notification until the next interval. Typically, missed event notifications are not lost, but delayed.

  Occurs when an entry is written to an event log on the local computer.

- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Boolean ``

  Use this method to determine if a log exists on the local computer. If you want to determine whether a source exists on the local computer, use .

  Because this method accesses the registry, you must have the appropriate registry permissions on the local computer; otherwise, the query returns false.

  Because you cannot give a new log the name of an existing log on the same computer, use this method before creating a new log to determine if the specified already exists on the local computer. The parameter is not case sensitive.

  is a static method, so it can be called on the class itself. It is not necessary to create an instance of to call .

  Determines whether the log exists on the local computer.

  true if the log exists on the local computer; otherwise, false.

  The name of the log to search for. Possible values include: Application, Security, System, other application-specific logs (such as those associated with Active Directory), or any custom log on the computer.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.MonoNotSupported("remote machine is not supported")
  System.Boolean `` ``

  Use this method to determine if a log exists on a remote computer. If you want to determine whether a source exists on a remote computer, use .

  Because this method accesses the registry, you must have the appropriate registry permissions on the specified computer; otherwise, the query returns false.

  Because you cannot give a new log the name of an existing log on the same computer, use this method before creating a new log to determine if one with the specified already exists on the server specified by the parameter. The and parameters are not case sensitive.

  is a static method, so it can be called on the class itself. It is not necessary to create a new instance of to call .

  Determines whether the log exists on the specified computer.

  true if the log exists on the specified computer; otherwise, false.

  The log for which to search. Possible values include: Application, Security, System, other application-specific logs (such as those associated with Active Directory), or any custom log on the computer. The name of the computer on which to search for the log, or "." for the local computer.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Diagnostics.EventLog[]

  The array of objects is a snapshot of all event logs on the local computer when the call to is made. This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. You should verify that a log in the array exists before you read or write to it. The array usually includes at least three logs: Application, System, and Security. If you created custom logs on the local computer, they will appear in the array as well.

  To retrieve the list of event logs, you must have the appropriate registry permissions. These permissions are identical to those required to call and .

  Searches for all event logs on the local computer and creates an array of objects that contain the list.

  An array of type that represents the logs on the local computer.

- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.MonoNotSupported("remote machine is not supported")
  System.Diagnostics.EventLog[] ``

  The array of objects is a snapshot of all event logs on the computer specified by the parameter when the call to is made. This is not a dynamic collection, so it does not reflect the deletion or creation of logs in real time. You should verify that a log in the array exists before you read or write to it. The array usually includes at least three logs: Application, System, and Security. If you created custom logs on the specified computer, they will appear in the array as well.

  is a static method, so it can be called on the class itself. It is not necessary to create an instance of an object to make a call to the method.

  To retrieve the list of event logs, you must have the appropriate registry permissions. These permissions are identical to those required to call and .

  Searches for all event logs on the given computer and creates an array of objects that contain the list.

  An array of type that represents the logs on the given computer.

  The computer on which to search for event logs.
- Property
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.ComponentModel.DefaultValue("")
  System.ComponentModel.ReadOnly(true)
  System.ComponentModel.RecommendedAsConfigurable(true)
  System.ComponentModel.TypeConverter("System.Diagnostics.Design.LogConverter, System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")
  System.Diagnostics.MonitoringDescription("Name of the log that is read and written.")
  System.String To be added: an object of type 'string'

  Three log files exist by default on the server: Application, System, and Security. Applications and services use the Application log file. Device drivers use the System log file. The system generates success and failure audit events in the Security log when auditing is turned on. If you have other applications installed, like Active Directory on Windows servers, there might be other default log files. In addition, you can create custom log files on a local or remote computer. Custom logs help organize your entries in a more detailed way than is allowed when your components write events to the default Application log.

  Log names are limited to eight characters. According to the system, MyLogSample1 and MyLogSample2 are the same log.

  If you write to an event log, it is not enough to specify the property. You must associate a property with your event log resource to connect it to a particular log. It is not necessary to specify a when only reading from a log, but an event source must be associated with the event log resource in the server's registry. You can specify only the name and (server computer name) to read from it.

  You are not required to specify the if you are connecting to a log. If you do not specify the , the local computer (".") is assumed.

  If the property has not been specified, a call to returns an empty string if has not been explicitly set (by setting the property, or through the constructor). If the has been specified, returns the name of the log to which that source was registered.

  A source can only be registered to one log at a time. If the property was set for an instance of , you cannot change the property for that without changing the value of or calling first. If you change the property after the property has been set, writing a log entry throws an exception.

  The operating system stores event logs as files. When you use or to create a new event log, the associated file is stored in the %SystemRoot%\System32\Config directory on the specified computer. The file name is set by appending the first 8 characters of the property with the ".evt" file name extension.

  You cannot create a new log using the property alone (without specifying a source for the log). You can call , passing in a new log name as a parameter, and then call . However, the intent is usually either to create (and write entries to) new application-specific logs, or to read from existing logs.

  If the value changes, the event log is closed and all event handles are released.

  If you set the property to the name of a log that does not exist, the system attaches the to the Application log, but does not warn you that it is using a log other than the one you specified.

  Gets or sets the name of the log to read from or write to.

- Property
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.ComponentModel.Browsable(false)
  System.String To be added: an object of type 'string'

  In Windows Vista and later, users do not have permission to access the security log. If you are running Windows Vista or later as a user, you will get a when you attempt to access the display name for an event in the security log.

  In Windows Vista and later, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses the security log, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.

  Gets the event log's friendly name.

- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.MonoNotSupported("remote machine is not supported")
  System.String `` ``

  The event source indicates what logs the event. It is often the name of the application, or the name of a subcomponent of the application, if the application is large. Applications and services should write to the Application log or a custom log. Device drivers should write to the System log.

  When you create a new source, which can only write to one log at a time, the system registers your application with the event log as a valid source of entries. The property can be any string, but the name cannot be used by other sources on the computer. An attempt to create a duplicated value throws an exception. However, a single event log can have many different sources writing to it.

  Gets the name of the log to which the specified source is registered.

  The name of the log associated with the specified source in the registry.

  The name of the event source. The name of the computer on which to look, or "." for the local computer.
- Property
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.ComponentModel.DefaultValue(".")
  System.ComponentModel.ReadOnly(true)
  System.ComponentModel.RecommendedAsConfigurable(true)
  System.Diagnostics.MonitoringDescription("Name of the machine that this log get written to.")
  System.String To be added: an object of type 'string'

  If you write to an event log, you must associate a with your event log object to connect it to a particular log. It is not necessary to specify the property when only reading from a log. You can specify only the name and (server computer name).

  You need not specify the if you are connecting to a log. If you do not specify the , the local computer (".") is assumed.

  A source can only be registered to one log at a time. If the property was set for an instance of , you cannot change the property for that without changing the value of or calling first. If you change the property, the closes all handles and reattaches to the log and source on the new computer.

  The value cannot be an empty string. If it is not explicitly set, it defaults to the local computer (".").

  Gets or sets the name of the computer on which to read or write events.

- Property
  2.0.0.0
  4.0.0.0
  System.ComponentModel.Browsable(false)
  System.ComponentModel.DesignerSerializationVisibility(System.ComponentModel.DesignerSerializationVisibility.Hidden)
  System.MonoTODO
  System.Runtime.InteropServices.ComVisible(false)
  System.Int64 To be added.

  The property represents the size limit of the event log file. When the event log reaches the size limit, the configured value determines whether new entries are discarded, or whether new entries overwrite older entries.

  This property represents a configuration setting for the event log represented by this instance. When the event log reaches its maximum size, this property specifies how the operating system handles new entries written by all event sources registered for the event log.

  Gets or sets the maximum event log size in kilobytes.

- Property
  2.0.0.0
  4.0.0.0
  System.ComponentModel.Browsable(false)
  System.MonoTODO
  System.Runtime.InteropServices.ComVisible(false)
  System.Int32 To be added.

  Use the property to examine the current setting for an event log. Use to change the minimum number of days that each entry in the event log must be retained.

  The value depends on the configured overflow behavior of the event log. If the property for an event log is set to , then the value is 0. If the property for an event log is set to , then the value is -1. If the property for an event log is set to , then the value is greater than zero, and represents the number of days to retain event log entries when the event log is full.

  The overflow behavior only occurs when an event log reaches its size limit. When an has its set to , and the event log reaches its maximum size, then new entries are written only if they can replace entries whose age exceeds the period. Retaining event entries for a minimum period is appropriate when the event log is archived regularly. Otherwise, you risk losing new entries when the event log reaches its limit. To avoid losing new event information, set the minimum retention days for events based on your archive schedule for a particular event log.

  Gets the number of days to retain entries in the event log.

- Method
  2.0.0.0
  4.0.0.0
  System.MonoTODO
  System.Runtime.InteropServices.ComVisible(false)
  System.Void `` ``

  The overflow behavior for an event log specifies what happens when new entries are to be written to a log that has reached its maximum file size.

  The overflow behavior takes effect only when an event log reaches its maximum file size. The overflow behavior does not affect writing a new entry to a log that can accommodate additional event log entries.

  The method configures the overflow behavior of an event log. instance. After calling this method for the event log specified by the property, the and property values reflect the newly configured overflow behavior.

  This property represents a configuration setting for the event log represented by this instance. When the event log reaches its maximum size, this property specifies how the operating system handles new entries written by all event sources registered for the event log.

  Set the parameter to to indicate that a new entry overwrites the oldest entry when the reaches its maximum size. If the parameter is set to , the parameter value is ignored.

  Set the parameter to to indicate that each new entry overwrites older entries when the reaches its maximum size. Specify the number of days that events must be retained in the log using the parameter. Events written within the retention range are not overwritten by new entries.

  Set the parameter to to discard new events when the maximum log size is reached. If the parameter is set to , the parameter value is ignored.

  Setting the overflow policy to specifies that new entries are discarded when the event log is full. If you use this setting, ensure the event log is regularly archived and cleared to avoid reaching its maximum size limit.

  Changes the configured behavior for writing new entries when the event log reaches its maximum file size.

  The overflow behavior for writing new entries to the event log. The minimum number of days each event log entry is retained. This parameter is used only if is set to .
- Property
  2.0.0.0
  4.0.0.0
  System.ComponentModel.Browsable(false)
  System.MonoTODO
  System.Runtime.InteropServices.ComVisible(false)
  System.Diagnostics.OverflowAction To be added.

  Event logs grow in size as new events are written to them. Each event log has a configured maximum size limit; the property defines the maximum number of kilobytes allowed for the event log file size.

  Use the property value to examine the configured overflow behavior for an event log at its maximum size. Use the method to change the overflow behavior for an event log.

  The overflow behavior takes effect only when an event log reaches its maximum file size. The overflow behavior does not affect writing a new entry to a log that can accommodate additional event log entries.

  Gets the configured behavior for storing new entries when the event log reaches its maximum log file size.

- Method
  2.0.0.0
  4.0.0.0
  System.MonoTODO
  System.Runtime.InteropServices.ComVisible(false)
  System.Void `` ``

  Use to register and display a localized name in the Event Viewer for custom event logs.

  The specified resource identifier must correspond to a localized string defined in the resource file. The Event Viewer displays the custom event log name using the localized string and the current culture settings. For example, you can define multiple event log names localized for different cultures in your resource file. The Event Viewer displays the localized string corresponding to the culture settings of the current user.

  If the Event Viewer cannot load the localized string from the resource file, or if no display name was registered for the event log, then the Event Viewer displays the event log name defined in .

  You do not need to register a display name for the pre-defined event logs. The operating system registers the localized display names for the Application, System, and Security event logs.

  Specifies the localized name of the event log, which is displayed in the server Event Viewer.

  The fully specified path to a localized resource file. The resource identifier that indexes a localized string within the resource file.
- Property
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.ComponentModel.DefaultValue("")
  System.ComponentModel.ReadOnly(true)
  System.ComponentModel.RecommendedAsConfigurable(true)
  System.ComponentModel.TypeConverter("System.Diagnostics.Design.StringValueConverter, System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a")
  System.Diagnostics.MonitoringDescription("The application name that writes the log.")
  System.String To be added: an object of type 'string'

  The event source indicates what logs the event. It is often the name of the application, or the name of a subcomponent of the application, if the application is large. Applications and services should write to the Application log or a custom log. Device drivers should write to the System log.

  You only need to specify an event source if you are writing to an event log. Before writing an entry to an event log, you must register the event source with the event log as a valid source of events. When you write a log entry, the system uses the property to find the appropriate log in which to place your entry. If you are reading the event log, you can either specify the , or a and .

  You are not required to specify the if you are connecting to a log on the local computer. If you do not specify the , the local computer (".") is assumed.

  Use and to write events to an event log. You must specify an event source to write events; you must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  You can create an event source for an existing event log or a new event log. When you create a new source for a new event log, the system registers the source for that log, but the log is not created until the first entry is written to it.

  The source must be unique on the local computer; a new source name cannot match an existing source name or an existing event log name. Each source can write to only one event log at a time; however, your application can use multiple sources to write to multiple event logs. For example, your application might require multiple sources configured for different event logs or different resource files.

  If you change the value, the to which it is registered is closed and all event handles are released.

  The source must be configured either for writing localized entries or for writing direct strings. If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  To change the configuration details of an existing source, you must delete the source and then create it with the new configuration. If other applications or components use the existing source, create a new source with the updated configuration rather than deleting the existing source.

  If a source has already been mapped to a log and you remap it to a new log, you must restart the computer for the changes to take effect.

  Gets or sets the source name to register and use when writing to the event log.

- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Boolean ``

  Use this method to determine whether an event source exists on the local computer. If you want to determine whether a log exists on the local computer, use .

  Because this method accesses the registry, you must have the appropriate registry permissions on the local computer; otherwise, a will be thrown.

  To search for an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges.

  The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a is thrown.

  Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses performance counters, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.

  A service that is executing under the account does not have the privileges required to execute this method. The solution is to check whether the event source exists in the , and if it does not exist, to create the source in the installer.

  Because you cannot give a new source the name of an existing source on the same computer, use this method before attempting to call to ensure that a source with the name specified by does not already exist on the local computer. The parameter is not case-sensitive.

  Determines whether an event source is registered on the local computer.

  true if the event source is registered on the local computer; otherwise, false.

  The name of the event source.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.MonoNotSupported("remote machine is not supported")
  System.Boolean `` ``

  Use this method to determine whether an event source exists on the computer specified by the parameter. If you want to determine whether a log exists on the specified computer, use .

  Because this method accesses the registry, you must have the appropriate registry permissions on the given server; otherwise, a will be thrown.

  To search for an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges.

  The reason for this requirement is that all event logs, including security, must be searched to determine whether the event source is unique. Starting with Windows Vista, users do not have permission to access the security log; therefore, a is thrown.

  Starting with Windows Vista, User Account Control (UAC) determines the privileges of a user. If you are a member of the Built-in Administrators group, you are assigned two run-time access tokens: a standard user access token and an administrator access token. By default, you are in the standard user role. To execute the code that accesses performance counters, you must first elevate your privileges from standard user to administrator. You can do this when you start an application by right-clicking the application icon and indicating that you want to run as an administrator.

  A service that is executing under the account does not have the privileges required to execute this method. The solution is to check whether the event source exists in the , and if it does not exist, to create the source in the installer.

  Because you cannot give a new source the name of an existing source on the same computer, use this method before attempting to call to ensure that a source with the name specified by does not already exist on the computer. The and parameters are not case sensitive.

  is a static method, so it can be called on the class itself. It is not necessary to create an instance of to call .

  Determines whether an event source is registered on a specified computer.

  true if the event source is registered on the given computer; otherwise, false.

  The name of the event source. The name the computer on which to look, or "." for the local computer.
- Property
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.ComponentModel.Browsable(false)
  System.ComponentModel.DefaultValue(null)
  System.Diagnostics.MonitoringDescription("An object that synchronizes event handler calls.")
  System.ComponentModel.ISynchronizeInvoke To be added: an object of type 'ComponentModel.ISynchronizeInvoke'

  When is null, methods handling the event are called on a thread from the system thread pool. For more information on system thread pools, see .

  When the event is handled by a visual Windows Forms component, such as a button, accessing the component through the system thread pool might not work, or might result in an exception. Avoid this by setting to a Windows Forms component, which causes the methods handling the event to be called on the same thread on which the component was created.

  If the is used inside vsprvslong in a Windows Forms designer, is automatically set to the control containing the . For example, if you place an on a designer for Form1 (which inherits from ) the property of is set to the instance of Form1.

  Gets or sets the object used to marshal the event handler calls issued as a result of an entry written event.

- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void ``

  Use this method to write an information entry to the event log associated with this instance. If you want to specify any other , use a different overload of .

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  You must set the property on your component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  If the source specified in the property of this instance is not registered on the computer that your component is writing to, calls and registers the source.

  If you do not specify a for your instance before you call or , the local computer (".") is assumed.

  If the system needs to register the through a call to and the property has not been set on your instance, the log defaults to the Application log.

  Many of the exceptions listed above are generated by errors raised during the process of registering the .

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  Writes an information type entry, with the given message text, to the event log.

  The string to write to the event log.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` ``

  Use this method to write an entry of a specified to the event log. The is indicated by an icon and text in the Type column in the Event Viewer for a log.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  You must set the property on your component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  If the source specified in the property of this instance is not registered on the computer that your component is writing to, calls and registers the source.

  If you do not specify a for your instance before you call or , the local computer (".") is assumed.

  If the system needs to register the through a call to and the property has not been set on your instance, the log defaults to the Application log.

  Many exceptions listed above are generated by errors raised during the process of registering the .

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  Writes an error, warning, information, success audit, or failure audit entry with the given message text to the event log.

  The string to write to the event log. One of the values.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` ``

  Use this method to write an information entry to the event log, using a source that is already registered as an event source for the appropriate log. If you want to specify any other , use a different overload of .

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  Writes an information type entry with the given message text to the event log, using the specified registered event source.

  The source by which the application is registered on the specified computer. The string to write to the event log.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` `` ``

  Use this method to write an entry with an application-defined to the event log. The together with the source uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  In addition to the event identifier, you can specify an for the event being written to the event log. The is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.

  You must set the property on your component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  If the source specified in the property of this instance is not registered on the computer that your component is writing to, calls and registers the source.

  If you do not specify a for your instance before you call or , the local computer (".") is assumed.

  If the system needs to register the through a call to and the property has not been set on your instance, the log defaults to the Application log.

  Many exceptions listed above are generated by errors raised during the process of registering the .

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  Writes an entry with the given message text and application-defined event identifier to the event log.

  The string to write to the event log. One of the values. The application-specific identifier for the event.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` `` ``

  Use this method to write an entry of a specified to the event log, using a source already registered as an event source for the appropriate log. The is indicated by an icon and text in the Type column in the Event Viewer for a log.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  Writes an error, warning, information, success audit, or failure audit entry with the given message text to the event log, using the specified registered event source.

  The source by which the application is registered on the specified computer. The string to write to the event log. One of the values.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` `` `` ``

  Use this method to write an entry with an application-defined to the event log. The Event Viewer uses the category to filter events written by an event source. The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.

  The parameter should be a positive value. Negative category values appear as a complementary positive number in the Event Viewer. For example, a –10 appears as 65,526, a –1 as 65,535.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  To display localized category strings in the Event Viewer, you must use an event source configured with a category resource file, and set the to a resource identifier in the category resource file. If the event source does not have a configured category resource file, or the specified does not index a string in the category resource file, then the Event Viewer displays the numeric category value for that entry. Configure the category resource file, along with the number of category strings in the resource file, using the or the class.

  In addition to the category, you can specify an event identifier for the event being written to the event log. Event identifiers, along with the event source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.

  Finally, you can specify an for the event being written to the event log. The is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.

  You must set the property on your component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  If the source specified in the property of this instance is not registered on the computer that your component is writing to, calls and registers the source.

  If you do not specify a for your instance before you call or , the local computer (".") is assumed.

  If the system needs to register the through a call to and the property has not been set on your instance, the log defaults to the Application log.

  Many exceptions listed above are generated by errors raised during the process of registering the .

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log.

  The string to write to the event log. One of the values. The application-specific identifier for the event. The application-specific subcategory associated with the message.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` `` `` ``

  Use this method to write an entry with an application-defined to the event log, using a source already registered as an event source for the appropriate log. The , along with the source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers present these strings to the user to help the user understand what went wrong and suggest what actions to take.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  In addition to the event identifier, this overload of lets you specify an for the event being written to the event log. The is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  Writes an entry with the given message text and application-defined event identifier to the event log, using the specified registered event source.

  The source by which the application is registered on the specified computer. The string to write to the event log. One of the values. The application-specific identifier for the event.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` `` `` `` ``

  Use this overload to write application-defined event-specific data to the event log. The Event Viewer does not interpret this data; it displays raw data only in a combined hexadecimal and text format. Use event-specific data sparingly, including it only if you are sure it will be useful to someone debugging the problem. You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the logfile and creates reports that include information from the event-specific data.

  In addition to the binary data, you can specify an application-defined category and an application-defined event identifier. The Event Viewer uses the category to filter events written by an event source. The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  The parameter should be a positive value. Negative category values appear as a complementary positive number in the Event Viewer. For example, a –10 appears as 65,526, a –1 as 65,535.

  To display localized category strings in the Event Viewer, you must use an event source configured with a category resource file, and set the to a resource identifier in the category resource file. If the event source does not have a configured category resource file, or the specified does not index a string in the category resource file, then the Event Viewer displays the numeric category value for that entry. Configure the category resource file, along with the number of category strings in the resource file, using the or the class.

  Event identifiers, along with the event source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.

  Finally, you can specify an for the event being written to the event log. The is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.

  You must set the property on your component before you can write entries to the log. You must create and configure the event source before writing the first entry with the source.

  Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  If the source specified in the property of this instance is not registered on the computer that your component is writing to, calls and registers the source.

  If you do not specify a for your instance before you call or , the local computer (".") is assumed.

  If the system needs to register the through a call to and the property has not been set on your instance, the log defaults to the Application log.

  Many exceptions listed above are generated by errors raised during the process of registering the .

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If you write an entry to a remote computer, the value of the message (the text string) might not be what you expect if the remote computer is not running the .NET Framework.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log, and appends binary data to the message.

  The string to write to the event log. One of the values. The application-specific identifier for the event. The application-specific subcategory associated with the message. An array of bytes that holds the binary data associated with the entry.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` `` `` `` ``

  Use this method to write an entry with an application-defined to the event log, using a source that is already registered as an event source for the appropriate log. The Event Viewer uses the category to filter events written by an event source. The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.

  The parameter should be a positive value. Negative category values appear as a complementary positive number in the Event Viewer. For example, a –10 appears as 65,526, a –1 as 65,535.

  To display localized category strings in the Event Viewer, you must use an event source configured with a category resource file, and set the to a resource identifier in the category resource file. If the event source does not have a configured category resource file, or the specified does not index a string in the category resource file, then the Event Viewer displays the numeric category value for that entry. Configure the category resource file, along with the number of category strings in the resource file, using the or the class.

  In addition to the category, you can specify an event identifier for the event being written to the event log. Event identifiers, along with the event source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.

  Finally, you can specify an for the event being written to the event log. The is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log, using the specified registered event source. The can be used by the Event Viewer to filter events in the log.

  The source by which the application is registered on the specified computer. The string to write to the event log. One of the values. The application-specific identifier for the event. The application-specific subcategory associated with the message.
- Method
  1.0.5000.0
  2.0.0.0
  4.0.0.0
  System.Void `` `` `` `` `` ``

  Use this method to write application-defined event-specific data to the event log, using a source already registered as an event source for the appropriate log. The Event Viewer does not interpret this data; it displays raw data only in a combined hexadecimal and text format. Use event-specific data sparingly; include it only if you are sure it will be useful. You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the logfile and creates reports that include information from the event-specific data.

  In addition to the binary data, you can specify an application-defined category and an application-defined event identifier. The Event Viewer uses the category to filter events written by an event source. The Event Viewer can display the category as a numeric value, or it can use the category as a resource identifier to display a localized category string.

  The parameter should be a positive value. Negative category values appear as a complementary positive number in the Event Viewer. For example, a –10 will appear as 65,526, a –1 as 65,535.

  To display localized category strings in the Event Viewer, you must use an event source configured with a category resource file, and set the to a resource identifier in the category resource file. If the event source does not have a configured category resource file, or the specified does not index a string in the category resource file, then the Event Viewer displays the numeric category value for that entry. Configure the category resource file, along with the number of category strings in the resource file, using the or the class.

  Event identifiers, together with the event source, uniquely identify an event. Each application can define its own numbered events and the description strings to which they map. Event viewers display these string values to help the user understand what went wrong and suggest what actions to take.

  Finally, you can specify an for the event being written to the event log. The is indicated by an icon and text in the Type column in the Event Viewer for a log. This parameter indicates whether the event type is error, warning, information, success audit, or failure audit.

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  The source must be configured either for writing localized entries or for writing direct strings. The method writes the given string directly to the event log; it does not use a localizable message resource file. Use the method to write events using a localized message resource file.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If the parameter contains a NUL character, the message in the event log is terminated at the NUL character.

  The string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  Writes an entry with the given message text, application-defined event identifier, and application-defined category to the event log (using the specified registered event source) and appends binary data to the message.

  The source by which the application is registered on the specified computer. The string to write to the event log. One of the values. The application-specific identifier for the event. The application-specific subcategory associated with the message. An array of bytes that holds the binary data associated with the entry.
- Method
  2.0.0.0
  4.0.0.0
  System.Runtime.InteropServices.ComVisible(false)
  System.Void `` `System.ParamArray`

  Use this method to write a localized entry to the event log. You specify the event properties with resource identifiers rather than string values. The Event Viewer uses the resource identifiers to display the corresponding strings from the localized resource file for the . You must register the source with the corresponding resource file before you write events using resource identifiers.

  The input instance specifies the event message and properties. Set the of the input for the defined message in the source message resource file. You can optionally set the and of the input to define the category and event type of your event entry. You can also specify an array of language-independent strings to insert into the localized message text. Set to null if the event message does not contain formatting placeholders for replacement strings.

  You must set the property on your component before using . The specified source must be configured for writing localized entries to the log; the source must at minimum have a message resource file defined.

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  The source must be configured either for writing localized entries or for writing direct strings. Use the method if your application writes string values directly to the event log.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If you write an entry to a remote computer, the value of the string might not be what you expect if the remote computer is not running the .NET Framework. Also, the string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  Writes a localized entry to the event log.

  An instance that represents a localized event log entry. An array of strings to merge into the message text of the event log entry.
- Method
  2.0.0.0
  4.0.0.0
  System.Runtime.InteropServices.ComVisible(false)
  System.Void `` `` `System.ParamArray`

  Use this method to write a localized entry with additional event-specific data to the event log. You specify the event properties with resource identifiers rather than string values. The Event Viewer uses the resource identifiers to display the corresponding strings from the localized resource file for the . You must register the source with the corresponding resource file before you write events using resource identifiers.

  The input instance specifies the event message and properties. Set the of the input for the defined message in the source message resource file. You can optionally set the and of the input to define the category and event type of your event entry. You can also specify an array of language-independent strings to insert into the localized message text. Set to null if the event message does not contain formatting placeholders for replacement strings.

  Specify binary data with an event when it is necessary to provide additional details for the event. For example, use the parameter to include information on a specific error. The Event Viewer does not interpret the associated event data; it displays the data in a combined hexadecimal and text format. Use event-specific data sparingly; include it only if you are sure it will be useful. You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the event log and creates reports that include information from the event-specific data.

  You must set the property on your component before component before using . The specified source must be configured for writing localized entries to the log; the source must at minimum have a message resource file defined.

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  If you do not specify a for your instance before you call , the local computer (".") is assumed.

  The source must be configured either for writing localized entries or for writing direct strings. Use the method if your application writes string values directly to the event log.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  If you write an entry to a remote computer, the value of the string might not be what you expect if the remote computer is not running the .NET Framework. Also, the string cannot contain %n, where n is an integer value (for example, %1), because the event viewer treats it as an insertion string. Because an Internet Protocol, version 6 (IPv6) address can contain this character sequence, you cannot log an event message that contains an IPv6 address.

  Writes an event log entry with the given event data, message replacement strings, and associated binary data.

  An instance that represents a localized event log entry. An array of bytes that holds the binary data associated with the entry. An array of strings to merge into the message text of the event log entry.
- Method
  2.0.0.0
  4.0.0.0
  System.Void `` `` `System.ParamArray`

  Use this method to write a localized entry to the event log, using a source already registered as an event source for the appropriate log. You specify the event properties with resource identifiers rather than string values. The Event Viewer uses the resource identifiers to display the corresponding strings from the localized resource file for the source. You must register the source with the corresponding resource file before you write events using resource identifiers.

  The input instance specifies the event message and properties. Set the of the input for the defined message in the source message resource file. You can optionally set the and of the input to define the category and event type of your event entry. You can also specify an array of language-independent strings to insert into the localized message text. Set to null if the event message does not contain formatting placeholders for replacement strings.

  The specified source must be registered for an event log before using . The specified source must be configured for writing localized entries to the log; the source must at minimum have a message resource file defined.

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  The source must be configured either for writing localized entries or for writing direct strings. Use the method if your application writes string values directly to the event log.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  Writes an event log entry with the given event data and message replacement strings, using the specified registered event source.

  The name of the event source registered for the application on the specified computer. An instance that represents a localized event log entry. An array of strings to merge into the message text of the event log entry.
- Method
  2.0.0.0
  4.0.0.0
  System.Void `` `` `` `System.ParamArray`

  Use this method to write a localized entry with additional event-specific data to the event log, using a source already registered as an event source for the appropriate log. You specify the event properties with resource identifiers rather than string values. The Event Viewer uses the resource identifiers to display the corresponding strings from the localized resource file for the source. You must register the source with the corresponding resource file before you write events using resource identifiers.

  The input instance specifies the event message and properties. Set the of the input for the defined message in the source message resource file. You can optionally set the and of the input to define the category and event type of your event entry. You can also specify an array of language-independent strings to insert into the localized message text. Set to null if the event message does not contain formatting placeholders for replacement strings.

  Specify binary data with an event when it is necessary to provide additional details for the event. For example, use the parameter to include information on a specific error. The Event Viewer does not interpret the associated event data; it displays the data in a combined hexadecimal and text format. Use event-specific data sparingly; include it only if you are sure it will be useful. You can also use event-specific data to store information the application can process independently of the Event Viewer. For example, you could write a viewer specifically for your events, or write a program that scans the event log and creates reports that include information from the event-specific data.

  The specified source must be registered for an event log before using . The specified source must be configured for writing localized entries to the log; the source must at minimum have a message resource file defined.

  You must create and configure the event source before writing the first entry with the source. Create the new event source during the installation of your application. This allows time for the operating system to refresh its list of registered event sources and their configuration. If the operating system has not refreshed its list of event sources, and you attempt to write an event with the new source, the write operation will fail. You can configure a new source using an , or using the method. You must have administrative rights on the computer to create a new event source.

  The source must be configured either for writing localized entries or for writing direct strings. Use the method if your application writes string values directly to the event log.

  If your application writes entries using both resource identifiers and string values, you must register two separate sources. For example, configure one source with resource files, and then use that source in the method to write entries using resource identifiers to the event log. Then create a different source without resource files, and use that source in the method to write strings directly to the event log using that source.

  Writes an event log entry with the given event data, message replacement strings, and associated binary data, and using the specified registered event source.

  The name of the event source registered for the application on the specified computer. An instance that represents a localized event log entry. An array of bytes that holds the binary data associated with the entry. An array of strings to merge into the message text of the event log entry.