未找到源，但无法搜索部分或全部事件日志.无法访问的日志:安全 [英] The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security

问题描述

我收到错误:

未找到源，但无法找到部分或全部事件日志搜索.无法访问的日志:安全

The source was not found, but some or all event logs could not be searched. Inaccessible logs: Security

当我运行下面的代码来捕获 Win 2K12 R2 服务器 IIS 8.5 上的错误时

When I run below code to capture errors on Win 2K12 R2 server IIS 8.5

EventLog elog = new EventLog();
EventLog.CreateEventSource("MyApp", "Application");
EventLog.WriteEntry(Source, swError.ToString(), EventLogEntryType.Error);

我已授予对 HKLMSYSTEMCurrentControlSetserviceseventlog 的完全访问权限，但它仍然无法正常工作.我该怎么做才能修复它?

I've given full access to HKLMSYSTEMCurrentControlSetserviceseventlog but it is not working still. What shall I do to fix it?

推荐答案

参见 创建注册表项.

出现此问题的原因不仅是权限问题，还可能是由于未成功注册导致事件源密钥丢失(您需要管理员权限才能执行此操作 - 如果您只是像往常一样打开 Visual Studio 并正常运行程序)这还不够).确保您的事件源MyApp"已实际注册，即它出现在 HKEY_LOCAL_MACHINESYSTEMCurrentControlSetserviceseventlogApplication 下的注册表中.

This problem can occur not only due to permissions, but also due to event source key missing because it wasn't registered successfully (you need admin privileges to do it - if you just open Visual Studio as usual and run the program normally it won't be enough). Make sure that your event source "MyApp" is actually registered, i.e. that it appears in the registry under HKEY_LOCAL_MACHINESYSTEMCurrentControlSetserviceseventlogApplication.

来自 MSDN EventLog.CreateEventSource():

在 Windows Vista 及更高版本或 Windows Server 中创建事件源2003，您必须具有管理权限.

To create an event source in Windows Vista and later or Windows Server 2003, you must have administrative privileges.

因此，您必须以管理员身份运行事件源注册代码(另外，检查源之前是否已存在 - 请参阅上面的 MSDN 示例)，或者您可以手动将密钥添加到注册表:

So you must either run the event source registration code as an admin (also, check if the source already exists before - see the above MSDN example) or you can manually add the key to the registry:

1. 创建一个regkey HKEY_LOCAL_MACHINESYSTEMCurrentControlSetserviceseventlogApplicationMyApp;
2. 在里面，创建一个字符串值 EventMessageFile 并将其值设置为例如C:WindowsMicrosoft.NETFrameworkv2.0.50727EventLogMessages.dll

1. create a regkey HKEY_LOCAL_MACHINESYSTEMCurrentControlSetserviceseventlogApplicationMyApp;
2. inside, create a string value EventMessageFile and set its value to e.g. C:WindowsMicrosoft.NETFrameworkv2.0.50727EventLogMessages.dll

这篇关于未找到源，但无法搜索部分或全部事件日志.无法访问的日志:安全的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！