甚至可以在Vista下写入事件日志? [英] Is is even possible to write to the event log under Vista?
问题描述
我在生产中有一个间歇性错误的应用程序.我想添加一个错误跟踪功能，以便在通过全局处理例程传递错误时，会将条目写入事件日志.我希望该条目使用应用程序独有的事件源，以更好地跟踪错误.
因此，按照Microsoft自己的文档，我尝试了此操作:
I have an application in production that has intermittent errors. I would like to add an error tracking feature so that, when an error gets channeled through the global handling routines, an entry gets written to the Event Log. I would like for this entry to use an event source unique to the application, to better track the errors.
So following Microsoft''s own documentation, I tried this:
If Not EventLog.SourceExists("MyApp") Then<br /> EventLog.CreateEventSource("MyApp", "Application")<br /> End If<br /> MyLog.Source = "MyApp"<br /> MyLog.WriteEntry(DetailedMessage)<br />
不幸的是，EventLog.SourceExists引发了一个异常:框架试图检查日志的 ALL ，而不仅仅是应用程序"，并且Vista的精神病性偏执狂不允许框架进行检查系统日志.因此，我尝试始终创建源并忽略源已存在"异常，如下所示:
Unfortunately, EventLog.SourceExists throws an exception: the Framework attempts to check ALL of the logs, not just "Application", and Vista''s psychotic paranoia does not allow the Framework to check the System log. So I tried always creating the source and ignoring the "source already exists" exception, like this:
Try<br /> EventLog.CreateEventSource("MyApp", "Application")<br /> Catch ex As Exception<br /> 'Do nothing<br /> End Try<br /> MyLog.Source = "MyApp"<br /> MyLog.WriteEntry(TextBox1.Text.Trim)<br />
这一次在EventLog.CreateEventSource上引发了与系统日志相同的异常.因此，尝试写入条目会导致源不存在"异常.
我能够找到的解决方案包括通过将注册表项写入注册表项来手动创建事件源.密钥被放置在HKEY_LOCAL_MACHINE/System中. Vista的虚拟化"在该节点上拥有牢固的锁定，并将所有程序性读取和写入重定向到一个隔离的用户特定区域.这显然排除了由应用程序创建源的可能性，因为三个不同的用户将创建三个不同的日志，当我以管理员身份登录时，对我而言这些都不可见.而且由于此应用程序可在大约40台不同的计算机上运行，因此无法遍历每台计算机并手动配置注册表.
这时，我看到两个选项:
1.滚动我自己的事件日志.将错误写到XML文件中，并编写一个简单的查看器以显示信息.
2.将办公室中的每个工作站都回滚到XP，因为我受够了Vista.
请任何人，可以在Vista下使用事件日志吗?如果是这样，怎么办?
That throws the same exception about the System log, this time on EventLog.CreateEventSource. Attempting to write the entry therefore causes a "source does not exist" exception.
The solutions I have been able to find involve creating the event source manually, by writing the key to the registry. The key gets put in HKEY_LOCAL_MACHINE/System. Vista''s "virtualization" has a firm lock on that node and redirects all programatic reads and writes to an isolated, user specific zone. This apparently rules out having the application create the source, as three different users will create three different logs, none of which will be visible to me when I log in as an administrator. And because this app runs on about 40 different machines, it is not feasable to go around to every one and configure the registry manually.
At this point, I see two options:
1. Roll my own event log. Write the errors out to an XML file and write a simple viewer to present the information.
2. Roll every workstation in the office back to XP because I am fed up with Vista.
Please, anyone, is it possible to use the event log under Vista? If so, HOW?
推荐答案
就像写入注册表的HKLM部分一样，创建
事件源需要提升的特权.而且就像在注册表中写入
HKLM一样，没有提升运行的应用程序需要在安装时进行这些操作(这就是为什么许多安装程序会提示您UAC的原因).
从EventLog类文档:
" 如果写入事件日志，则必须指定或创建事件源.
您必须在计算机上具有管理权限才能创建新的事件源. "
Just like writing to the HKLM section of the registry, creating an
event source requires elevated privileges. And also just like writing to
HKLM in the registry, apps that runs without elevation need to do these operations
at install time (which is why many installers give you a UAC prompt).
From the EventLog class docs:
"If you write to an event log, you must specify or create an event Source.
You must have administrative rights on the computer to create a new event source."
请任何人都可以使用Vista下的事件日志?如果是这样，怎么办?
Please, anyone, is it possible to use the event log under Vista? If so, HOW?
是的.提供一些创建事件源的方法.一旦注册了源，就无需提升应用程序权限即可将其写入
事件日志.
Yes. Provide some way to create the event source. Once the source is
registered, no elevation will be required for the app to write to the
event log.
这篇关于甚至可以在Vista下写入事件日志?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
